DORA is the EU's Digital Operational Resilience Act, Regulation (EU) 2022/2554. It sets uniform rules for how EU financial entities manage ICT risk, report major ICT incidents, test their resilience and manage their technology suppliers. It has applied since 17 January 2025. DORA is not UK law. It was adopted in December 2022, after the Brexit transition period ended, so a UK-only firm is not directly bound by it. UK groups with EU-regulated subsidiaries must comply, however, and UK technology providers serving EU financial firms will feel it through their contracts.
What DORA covers
Article 1 sets out the requirements for financial entities in five areas, plus an oversight regime for the largest technology providers:
- ICT risk management. A documented framework, owned by the management body, covering identification, protection, detection, response, recovery and learning;
- Incident reporting. Classifying ICT-related incidents and reporting major ones to the competent authority. Notifying significant cyber threats is voluntary;
- Digital operational resilience testing. From basic vulnerability scans up to threat-led penetration testing (TLPT) for the most significant firms;
- Information sharing. Voluntary arrangements to exchange cyber threat intelligence between financial entities;
- ICT third-party risk. A third-party risk strategy, a register of all ICT contracts and mandatory contract terms;
- Oversight of critical ICT third-party providers. Direct supervision by the European Supervisory Authorities of the cloud and technology providers on which the sector depends.
Who DORA applies to
Article 2 lists 20 types of financial entity. These include credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, central counterparties, fund managers, insurers and insurance intermediaries, occupational pension funds, credit rating agencies and crowdfunding platforms. ICT third-party service providers are also in scope, for the oversight regime.
Proportionality is built in. A microenterprise is a financial entity with fewer than 10 staff and annual turnover and/or balance sheet not exceeding EUR 2 million. Certain smaller entities listed in Article 16, such as small and non-interconnected investment firms and exempted payment institutions, follow a simplified ICT risk management framework instead. Microenterprises are excused some obligations, such as TLPT and a formal strategy on ICT third-party risk.
Key obligations in numbers
| Requirement | Rule |
|---|---|
| Management body | Bears ultimate responsibility for managing the entity's ICT risk, and members must keep up to date through regular training |
| Initial incident notification | Within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it |
| Intermediate report | Within 72 hours of the initial notification |
| Final report | No later than one month after the latest intermediate report |
| Threat-led penetration testing | At least every 3 years for entities identified by the competent authority |
| Register of information | All ICT third-party contracts, at entity and group level, available to the regulator on request |
| Critical ICT providers outside the EU | Must set up an EU subsidiary within 12 months of designation |
| Penalty payments on critical providers | Up to 1% of average daily worldwide turnover |
The incident deadlines come from Commission Delegated Regulation (EU) 2025/301, which supplements DORA.
Contracts with ICT providers
Article 30 is where DORA reaches outside the EU. Every ICT services contract with an in-scope entity must be in writing, in a single document that includes the service levels. It must contain minimum terms, including a full description of the services, whether subcontracting is allowed, where services are provided and data is processed, access to and return of data if the provider fails, cooperation with regulators, and termination rights. For services supporting critical or important functions, it must also give unrestricted rights of access, inspection and audit, and include exit strategies with an adequate transition period. A UK software or managed-services company with EU bank or insurer clients should expect DORA addenda to its contracts, audit requests and questions about its own subcontractors, even though DORA does not regulate the company directly.
DORA and the UK
The UK left the EU on 31 January 2020, and the Brexit transition period ended at 11pm on 31 December 2020. EU legislation adopted after that point did not become part of UK law, and DORA was adopted on 14 December 2022. The UK has its own regime with similar aims:
- Operational resilience rules. These are SYSC 15A for FCA firms and the PRA's SS1/21, built around important business services and impact tolerances;
- Critical third parties regime. Under the Financial Services and Markets Act 2023 this has applied since 1 January 2025, and HM Treasury designated the first four providers on 13 July 2026;
- Incident and third-party reporting. The FCA's PS26/2 brings in a single reporting regime from 18 March 2027, including a register of material third-party arrangements submitted annually.
The two regimes overlap a great deal but differ in method. DORA is prescriptive about ICT controls, templates and deadlines. The UK regime is outcome-based and starts from the customer-facing service. Groups operating in both should build one control framework and map it to both sets of rules, rather than running two programmes.
Worked example: a UK group with an Irish subsidiary
A London-based payments group holds an FCA authorisation for its UK business and an e-money licence in Ireland for its EU customers. The Irish entity is a financial entity under DORA. It needs a DORA-compliant ICT risk framework approved by its own board, a register of information covering every ICT contract (including the group's shared UK IT services), DORA-standard terms in its intra-group service agreement, and an incident process able to notify its competent authority within the 4-hour and 24-hour windows.
The UK parent remains under SYSC 15A. In practice the group runs one incident playbook. It classifies each incident against both DORA's criteria and the FCA's thresholds, and the UK IT function is treated as an ICT third-party provider to the Irish entity.
The primary sources are the text of Regulation (EU) 2022/2554, Delegated Regulation (EU) 2025/301 on incident reporting deadlines, and, for the UK position, the FCA's operational resilience page and critical third parties page. For the UK rules in more depth, see our guide to operational resilience.
Acumon's IT risk and IT audit teams can run a DORA gap analysis, review ICT contracts and registers, and map controls across DORA and the UK operational resilience rules for groups that answer to both.