The EU regulation on ICT risk and digital operational resilience in financial services, applying since 17 January 2025.

Who does DORA apply to?

EU financial entities (banks, insurers, investment firms, payment institutions and more) and critical ICT third-party providers

What is the current version of DORA?

Regulation (EU) 2022/2554, plus its technical standards (RTS/ITS) and ESA guidelines

Who is responsible for DORA?

National competent authorities, with the EBA, EIOPA and ESMA overseeing critical ICT providers

Framework

DORA

Digital Operational Resilience Act

1 story in the last 90 daysLatest story 23 Sep 2026

What is DORA?: The EU regulation on ICT risk and digital operational resilience in financial services, applying since 17 January 2025.
Who does DORA apply to?: EU financial entities (banks, insurers, investment firms, payment institutions and more) and critical ICT third-party providers
What is the current version of DORA?: Regulation (EU) 2022/2554, plus its technical standards (RTS/ITS) and ESA guidelines
Who is responsible for DORA?: National competent authorities, with the EBA, EIOPA and ESMA overseeing critical ICT providers

Official text: EUR-Lex: Regulation (EU) 2022/2554

DORAIndustry newsEuropean Union1 month ago

European Supervisory Authorities warn banks and insurers of cyber risk from non-EU ICT providers

The EU's EBA, EIOPA and ESMA warn that reliance on non‑EU ICT providers and emerging AI technologies heightens systemic cyber risk for banks, insurers and fund managers.

1 source · official

DORAIndustry news4 months ago
European Systemic Risk Board warns frontier AI models could strain financial cyber resilience
The ESRB cautions that advanced AI models may increase cyber‑risk for banks and market infrastructures, urging heightened vigilance.
1 source · official
DORARegulatory update1 year ago
European Supervisory Authorities designate critical ICT providers under DORA on 18 November 2025
The EU's European Supervisory Authorities published the first list of critical ICT third‑party providers, applying DORA's methodology and triggering direct oversight of these vendors.
1 source · official

European Supervisory Authorities warn banks and insurers of cyber risk from non-EU ICT providers

European Systemic Risk Board warns frontier AI models could strain financial cyber resilience

European Supervisory Authorities designate critical ICT providers under DORA on 18 November 2025

European Supervisory Authorities warn banks and insurers of cyber risk from non-EU ICT providers

European Systemic Risk Board warns frontier AI models could strain financial cyber resilience

European Supervisory Authorities designate critical ICT providers under DORA on 18 November 2025