EveryAILaw.comDigital Operational Resilience Act (DORA)
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Adopted | Dec 14, 2022 | European Parliament and Council |
| Published in Official Journal | Dec 27, 2022 | Regulation (EU) 2022/2554 |
| Entered into force | Jan 17, 2025 | Directly applicable, no transposition |
| Critical third-party providers designated | Nov 18, 2025 | ESAs designate CTPPs |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
ICT Risk Management #
Requirements
| Requirement | Details |
|---|---|
| ICT risk management framework | Comprehensive framework for identifying, assessing, and mitigating ICT risks |
| Governance | Management body must approve and oversee the ICT risk management framework |
| Business continuity | Establish ICT business continuity and disaster recovery plans |
| Cyber risk management | Address cybersecurity risks as part of the ICT risk framework |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Determined by national competent authorities per member state law |
Sources: DORA Full Text
ICT Incident Reporting #
Requirements
| Requirement | Details |
|---|---|
| Classify incidents | Classify ICT-related incidents using ESA criteria |
| Major incident reporting | Notify competent authorities of major ICT incidents |
| Reporting thresholds | >24 hours duration, >2 hours critical service disruption, ≥2 EU states affected, or >EUR 100,000 economic impact |
| Voluntary threat reporting | Encouraged to report significant cyber threats |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Determined by national competent authorities per member state law |
Sources: DORA Full Text
Digital Operational Resilience Testing #
Requirements
| Requirement | Details |
|---|---|
| Resilience testing program | Conduct regular testing of ICT systems and tools |
| Threat-led penetration testing | Significant entities must perform TLPT aligned with TIBER-EU |
| Documentation and remediation | Document test results and remediate identified vulnerabilities |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Determined by national competent authorities per member state law |
Sources: DORA Full Text
Third-Party ICT Risk Management #
Requirements
| Requirement | Details |
|---|---|
| Contractual requirements | Key contractual provisions for ICT third-party service agreements |
| Concentration risk | Assess and manage concentration risk from third-party ICT dependencies |
| Critical provider oversight | Designated critical third-party providers (CTPPs) subject to ESA oversight |
| Exit strategies | Maintain exit strategies for critical ICT third-party services |
| Register of Information | Maintain and keep up-to-date a register of information on all ICT third-party contractual arrangements, and submit it to competent authorities upon request or as required (DORA Article 28) |
Penalties
| Violation | Fine |
|---|---|
| CTPP non-compliance | ESAs may impose periodic penalty payments on critical third-party providers |
Sources: DORA Full Text
Cite this regulation
Permalink: https://everyailaw.com/regulation/eu-dora/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “Digital Operational Resilience Act (DORA)”, EveryAILaw.com, Aug 15, 2026. https://everyailaw.com/regulation/eu-dora/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.