Regulationsby GlyphDORA
In force European Union · In force Jan 16, 2023 · no upcoming deadlines
Deadlines
First critical ICT third-party providers designatedThe ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.
TLPT regulatory technical standards enter into forceCommission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.
First registers of information submitted to the ESAsCompetent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.
DORA appliesAll DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).
DORA enters into forceEntered into force on the twentieth day after publication in OJ L 333 of 27 Dec 2022 (Art 64).
Summaries for reference, not legal advice. Check the official text.
What it does
Harmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.
- Who it applies to
- About 20 types of EU financial entities (credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, trading venues, CCPs and others) and ICT third-party service providers designated as critical. Microenterprises and some small entities get a simplified framework.
- Penalties
- Administrative penalties for financial entities are set by Member States. Critical ICT third-party providers face periodic penalty payments of up to 1% of average daily worldwide turnover of the preceding business year, imposed daily for up to six months (Art 35(8)).
- Enforced by
- National competent authorities for financial supervision; the European Supervisory Authorities (EBA, EIOPA, ESMA) as Lead Overseers of critical ICT third-party providers
- Official name
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act)
- Citation
- OJ L 333, 27.12.2022, p. 1
- Topics
- Cybersecurity, Financial, Breach notification
Research notes
TLPT must be performed at least every three years by entities identified by their competent authority (Art 26). There is no single EU-wide first-test date; each authority notifies its entities. Registers of information are now collected annually; confirm each year's deadline with the national authority. The Digital Omnibus proposal COM(2025) 837 does not amend DORA in its title, but its single-entry point for incident reporting could interact with DORA reporting.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsData Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsEU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 days
Questions about DORA
- What are the DORA compliance deadlines?
- Jan 16, 2023: DORA enters into force. Jan 17, 2025: DORA applies. Apr 30, 2025: First registers of information submitted to the ESAs. Jul 8, 2025: TLPT regulatory technical standards enter into force. Nov 18, 2025: First critical ICT third-party providers designated.
- When does DORA take effect?
- DORA took effect on Jan 16, 2023.
- Who does DORA apply to?
- About 20 types of EU financial entities (credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, trading venues, CCPs and others) and ICT third-party service providers designated as critical. Microenterprises and some small entities get a simplified framework.
- What are the penalties under DORA?
- Administrative penalties for financial entities are set by Member States. Critical ICT third-party providers face periodic penalty payments of up to 1% of average daily worldwide turnover of the preceding business year, imposed daily for up to six months (Art 35(8)).