Purpose and Objectives of Regulation (EU) 2022/2554 (DORA)
The Digital Operational Resilience Act (DORA), established under Regulation (EU) 2022/2554, mandates financial entities within the European Union to enhance their digital operational resilience. Its primary goal is to mitigate vulnerabilities across the financial sector’s value chain by establishing a uniform regulatory framework. This framework aims to reduce susceptibility to cyber threats and ICT-related incidents, thereby strengthening the overall security of the European financial market.
DORA seeks to harmonize national regulations concerning the security of IT systems in the financial sector. By doing so, it ensures consistency in how financial entities and their ICT service providers manage risks, respond to incidents, and maintain operational continuity.
The act emphasizes the importance of resilience in digital operations, particularly as financial institutions increasingly rely on AI systems and cloud-based services. These technologies, while offering significant efficiencies, introduce new layers of risk that must be systematically addressed through governance, testing, and incident response protocols.
Scope of Application: Financial Entities and Exclusions
DORA applies to a broad range of financial entities, as defined in Article 2 of the regulation. These include account information service providers, central counterparties, credit institutions, investment firms, payment institutions, and trading venues, among others.
The regulation also extends to third-party ICT service providers, recognizing that the resilience of financial entities depends not only on their internal systems but also on the security and reliability of their external partners. This includes cloud service providers, AI system developers, and other vendors supplying critical ICT infrastructure.
However, DORA does not apply uniformly across all entities. Certain exemptions are granted based on size and operational scale. Similarly, institutions for occupational retirement provision operating pension schemes with fewer than 15 members are not subject to DORA’s requirements.
These exemptions are designed to ensure proportionality, allowing smaller or lower-risk entities to implement simplified compliance measures aligned with their risk profiles.
Key Requirements Under DORA
DORA imposes several mandatory requirements on financial entities and their ICT service providers to ensure digital operational resilience. These requirements are structured across nine chapters, each addressing distinct aspects of ICT risk management, incident handling, testing, and third-party risk oversight.
ICT Risk Management (Articles 5–16)
Financial entities must establish and maintain an ICT risk management framework that aligns with their overall risk appetite and operational context. This framework must include policies, procedures, and controls to identify, assess, monitor, and mitigate ICT-related risks.
For smaller entities, DORA introduces a proportionality principle, allowing them to adopt a simplified ICT risk management framework. This approach is governed by regulatory technical standards (RTS) and implementing technical standards (ITS), which provide guidance on how to tailor compliance efforts to the specific risk profiles of different organizations. For instance, pension schemes with between 15 and 100 members are subject to a streamlined framework under Article 16.
ICT-Related Incident Management, Classification, and Reporting (Articles 17–23)
One of the most critical aspects of DORA is the requirement for financial entities to classify and report ICT-related incidents within strict timeframes. Entities must report significant incidents to competent authorities within four hours of detection.
Digital Operational Resilience Testing (Articles 24–27)
Financial entities are required to conduct regular testing of their ICT systems to ensure their resilience against cyber threats and operational disruptions.
For example, entities relying heavily on AI-driven decision-making or cloud-based infrastructure may face more stringent testing requirements.
Managing ICT Third-Party Risk (Articles 28–44)
DORA places significant emphasis on the management of risks associated with third-party ICT service providers. Financial entities must conduct due diligence on their providers, including assessments of their ICT risk management capabilities, financial stability, and compliance with relevant regulations. Contractual agreements must include clauses that hold providers accountable for breaches or failures in service, ensuring that financial entities are not left exposed to undue risk.
Critical ICT service providers, particularly those offering cloud services or AI systems, are subject to enhanced oversight. These providers may be directly supervised by EU authorities, depending on their role in the financial sector’s value chain.
Implementation and Compliance Framework
These standards provide practical guidance on how financial entities can meet the regulation’s requirements, particularly in areas such as ICT risk management, incident reporting, and third-party risk oversight.
Financial entities are expected to integrate these requirements into their existing governance frameworks, with phased implementation based on their size and complexity.
Compliance with DORA is not optional; it is a legal obligation for all in-scope entities. Given the interconnected nature of the financial sector, non-compliance by one entity can have cascading effects, underscoring the importance of proactive and rigorous adherence to DORA’s provisions.
Required actions
- Maintain an ICT risk-management framework covering AI and models as ICT assets, with testing and threat-led penetration testing for larger entities - Report major ICT incidents to the competent authority within four hours of classification and 24 hours of detection - Manage ICT third-party risk with mandatory contract terms and a register of arrangements; critical providers including cloud and AI platforms fall under EU oversight