DORA explained

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) sets requirements for the digital operational resilience of financial entities such as banks, payment institutions, insurers and investment firms. It has applied since 17 January 2025 and contains its own regime for managing ICT risk arising from external providers. For you as a buyer at such an entity, it determines what a cloud or software contract must contain and which questions you can put to a vendor.

Facts and dates last checked: 11 October 2026 · This page gives general information and is not legal advice; check the text of the Regulation and its technical standards for your situation.

Mastodon LinkedIn Bluesky X Email

Timeline

16 January 2023
The Regulation entered into force on the twentieth day after its publication in the Official Journal on 27 December 2022 (Art. 64).
2 December 2024
Implementing Regulation (EU) 2024/2956, with the standard templates for the register of information, was published in the Official Journal (Art. 28(9)).
17 January 2025
The Regulation applies (Art. 64).
2 July 2025
Delegated Regulation (EU) 2025/532, on the elements a financial entity must determine and assess when subcontracting ICT services supporting critical or important functions, was published in the Official Journal (Art. 30(5)).
18 November 2025
The European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of designated critical ICT third-party service providers (Art. 31(9)).

Who is in scope

DORA applies to the financial entities listed in Art. 2(1): among others credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, managers of alternative investment funds, management companies, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, crowdfunding service providers and securitisation repositories (Art. 2(1), points (a) to (t)).

There are exclusions, for example for occupational retirement institutions with no more than 15 members in total and for insurance intermediaries that are micro, small or medium-sized enterprises (Art. 2(3)). Member States may exclude certain other entities (Art. 2(4)). The measures are applied in proportion to the nature, scale and complexity of ICT dependencies and the importance of the service (Art. 28(1)(b)).

ICT third-party service providers are also listed in Art. 2(1), point (u), but are not a financial entity under Art. 2(2). The obligations on managing ICT third-party risk (Art. 28 to 30) rest on the financial entity, and a vendor meets them in practice through the contract. Only providers designated as critical fall under a direct oversight framework (see below). An ICT service is defined broadly: digital and data services provided through ICT systems to users on an ongoing basis, including hardware as a service (Art. 3(21)).

ICT third-party risk: register, contract and exit

A financial entity remains fully responsible at all times for compliance with the Regulation, including when it uses ICT services from others (Art. 28(1)(a)). It keeps a register of information on all contractual arrangements for ICT services provided by third parties, at entity level and, where relevant, at sub-consolidated and consolidated level. Arrangements covering critical or important functions are distinguished from the others (Art. 28(3)). The entity reports to the competent authority at least yearly and makes the register available on request. The standard templates are set out in Implementing Regulation (EU) 2024/2956.

Before entering into a contract, the entity assesses, among other things, whether the service supports a critical or important function, what risks arise, whether the provider is suitable and whether there are conflicts of interest (Art. 28(4)). It also looks at concentration risk: a provider that is not easily substitutable, or several arrangements for critical or important functions with the same or closely connected providers (Art. 29(1)). Where subcontracting is possible, it weighs the risks of long or complex chains and of subcontractors established in third countries. For a provider established in a third country, it also considers compliance with Union data protection rules and the effective enforcement of the law in that country (Art. 29(2)).

For ICT services supporting critical or important functions, the entity must have exit strategies. It must be able to exit an arrangement without disrupting its business, without limiting regulatory compliance and without detriment to the continuity and quality of services to clients. Exit plans are documented, tested and reviewed periodically. The entity identifies alternative solutions and develops transition plans to transfer the services and data securely and completely to another provider or back in-house (Art. 28(8)). Contracts must be terminable in circumstances including a significant breach, evidenced weaknesses in the provider's ICT risk management, or where the competent authority can no longer effectively supervise the entity (Art. 28(7)).

Art. 30 sets out the minimum content of the contract. For subcontracting, Delegated Regulation (EU) 2025/532 further specifies that the contract states which services may be subcontracted and under what conditions, that the provider remains responsible for the services of its subcontractors, that it announces material changes in good time with a reasonable notice period in which the entity can approve or object, and that the entity may provide for termination rights in certain cases (Art. 4 to 6 of that Regulation).

Oversight of critical ICT providers

The European Supervisory Authorities (EBA, EIOPA and ESMA, together the ESAs) designate critical ICT third-party service providers (CTPPs) through the Joint Committee. They consider the systemic impact of a large-scale failure, the systemic importance of the financial entities relying on the provider, the reliance for critical or important functions and the degree of substitutability (Art. 31(1) and (2)). One of the ESAs is appointed Lead Overseer for each designated provider (Art. 31(1)(b)).

Current status: on 18 November 2025 the ESAs published the first list of designated CTPPs, based on the registers of information kept by financial entities. The list is on the ESAs' website, in alphabetical order, and includes cloud service providers among others. Art. 31(9) requires the list to be updated yearly. Consult the ESAs for the current version.

A designated provider tells its customers about the designation, and oversight starts no later than one month after notification (Art. 31(5)). The Lead Overseer assesses whether the provider has sound rules and procedures to manage the ICT risk it may pose to financial entities, including data portability, application portability and interoperability (Art. 33(2) and (3)(f)), and may issue recommendations, including on subcontracting (Art. 35). A provider established in a third country must set up a subsidiary in the Union within twelve months of designation, otherwise financial entities may not use its services (Art. 31(12)).

Designation does not remove the financial entity's own responsibility (Art. 28(1)(a)). Whether a vendor is on the list is, however, a fact you can take into account in your risk assessment and in the register.

Incident reporting and the relation to NIS2

A financial entity reports major ICT-related incidents to the competent authority: an initial notification, an intermediate report and a final report (Art. 19(1) and (4)). A major incident is an ICT-related incident with a high adverse impact on the systems supporting critical or important functions (Art. 3(10)). The time limits and format follow from technical standards under Art. 20. If the incident affects the financial interests of clients, the entity informs them too (Art. 19(3)). Reporting may be outsourced, but the entity remains responsible (Art. 19(5)). For you as a buyer this means the vendor has to help: the contract contains an obligation to assist during an incident, at no additional cost or at a cost determined in advance (Art. 30(2)(f)).

DORA is lex specialis in relation to NIS2, Directive (EU) 2022/2555 (recital 16). For financial entities identified as essential or important entities under national NIS2 rules, DORA is a sector-specific Union act within the meaning of Art. 4 of that Directive (Art. 1(2)). Member States may determine that reports are also sent to CSIRTs (Art. 19(1)). The DORA oversight of critical providers is without prejudice to NIS2 and other Union rules on cloud computing providers (Art. 32(8)). The CRA, by contrast, concerns products and their manufacturers, whereas DORA concerns the use of ICT services by financial entities.

What to ask a vendor

Use the points below in tenders, questionnaires and contract negotiations. They follow from Art. 28 to 30 and from Delegated Regulation (EU) 2025/532. They are not exhaustive; for a critical or important function the additional requirements of Art. 30(3) apply.

Service description and subcontracting: which functions and services does the vendor provide, may it subcontract them and under what conditions? Who are the subcontractors supporting critical or important functions (Art. 30(2)(a); Regulation (EU) 2025/532, Art. 4)?
Locations: in which regions or countries are the services provided and data processed and stored, including by subcontractors, and does the vendor give advance notice of a change (Art. 30(2)(b))?
Data protection: what is agreed on availability, authenticity, integrity and confidentiality of personal and other data (Art. 30(2)(c))?
Access and return: how do you get your data back in an easily accessible format on insolvency, discontinuation or termination (Art. 30(2)(d))?
Incidents: does the vendor assist at no additional cost or at a cost fixed in advance, and does it cooperate fully with the authorities (Art. 30(2)(f) and (g))?
Termination: which termination rights and minimum notice periods apply, and can you terminate in the cases of Art. 28(7) (Art. 30(2)(h))?
Critical or important functions: are there service levels with precise quantitative and qualitative targets, reporting duties for developments that may affect delivery, tested contingency plans and mandatory cooperation in threat-led penetration testing (TLPT) (Art. 30(3)(a) to (d))?
Audit: do you and the competent authority have unrestricted rights of access, inspection and audit, and does the vendor cooperate (Art. 30(3)(e))?
Exit: is there a mandatory, adequate transition period in which the vendor keeps providing the service so you can migrate or bring it in-house (Art. 30(3)(f))?
Register: can the vendor supply the data you need for the templates of Implementing Regulation (EU) 2024/2956, and is it on the ESAs' list of critical providers?
Concentration: how dependent are you on this vendor or on providers connected to it, and is there a realistic alternative (Art. 29(1))?

DORA, the CLOUD Act and digital sovereignty

DORA does not mention the CLOUD Act or digital sovereignty. It does ask for insight into location and dependency: contracts state the regions or countries where services are provided and data is processed and stored (Art. 30(2)(b)); for a provider in a third country the entity weighs Union data protection rules and the effective enforcement of the law in that country (Art. 29(2)); and for subcontracting the provider assesses the risks tied to the location of subcontractors, their parent company and the place from which the service is provided (Regulation (EU) 2025/532, Art. 4(1)(d)). DORA itself allows for providers in third countries and sets conditions, such as a subsidiary in the Union for critical providers (Art. 31(12)).

The US CLOUD Act added section 2713 to 18 U.S.C. (Pub. L. 115-141, div. V, 23 March 2018). It provides that a provider of electronic communication service or remote computing service must preserve, back up or disclose communications and records within its possession, custody or control, regardless of whether they are located inside or outside the United States. The provision is therefore tied to the provider and not to the storage location. The storage location in the contract is one question, and where the provider and its parent company are established is another. Whether the provision applies to a specific provider, and how it interacts with EU law, is a legal assessment this page does not make.

For the five dimensions of the score: JES shows where the vendor and its ultimate parent are established, DRS covers data residency, PLS covers lock-in and portability, and SRS covers open source and self-hosting. These topics touch the contract points on location, exit and taking a service back in-house. The score is not a compliance assessment: whether a financial entity complies with DORA depends on its own register, contracts, testing and risk assessment.

Want to know how your own software stack scores on digital sovereignty? Take the free assessment.

Take the free assessment

Frequently asked questions

Since when does DORA apply?

The Regulation entered into force on 16 January 2023 and has applied since 17 January 2025 (Art. 64).

Is my organisation in scope?

That depends on the list in Art. 2(1), points (a) to (t), the exclusions in Art. 2(3) and the choices your Member State makes under Art. 2(4). ICT vendors are not financial entities themselves (Art. 2(2)).

If a vendor is on the ESAs' list of critical providers, is it suitable for me?

Not automatically. Designation puts the provider under direct oversight by the ESAs, but the financial entity itself remains fully responsible for compliance (Art. 28(1)(a)) and must have its own due diligence, contract and exit strategy in order.

What is the register of information?

An overview of all contractual arrangements for ICT services from third parties, distinguishing arrangements for critical or important functions from the rest (Art. 28(3)). The standard templates are in Implementing Regulation (EU) 2024/2956.

Does DORA prohibit using providers outside the EU?

Art. 29(2) and Art. 31(12) provide for providers in third countries and set conditions. A critical provider established in a third country must set up a subsidiary in the Union within twelve months of designation, otherwise financial entities may not use its services.

How does DORA relate to NIS2?

DORA is lex specialis in relation to NIS2 (recital 16). For financial entities identified as essential or important under NIS2, DORA is a sector-specific Union act (Art. 1(2)).

Must a vendor cooperate with audits and tests?

For services supporting critical or important functions the contract must contain unrestricted rights of access, inspection and audit, including for the competent authority, and cooperation in threat-led penetration testing (Art. 30(3)(d) and (e)).