DORA (Digital Operational Resilience Act) is the EU regulation on ICT risk management for financial entities and their critical technology providers. It standardizes how banks, insurers, and investment firms govern ICT risk, report incidents, test resilience, manage third parties, and share threat intelligence. The regulation entered into force January 16, 2023 and fully applied January 17, 2025.
Who has to comply with DORA?
DORA covers 21 categories of EU financial entities, including banks, insurers, and investment firms, plus the ICT third parties they use.
The European Supervisory Authorities (ESAs) directly oversee any ICT provider designated as a critical third-party provider, or CTPP, under Regulation 2022/2554. Designation criteria include systemic importance, substitutability, and concentration risk across the EU financial sector.
What are the five DORA pillars?
The text groups obligations into five areas: ICT risk management, incident reporting, resilience testing, third-party risk, and threat-intel sharing.
The third-party pillar requires every in-scope entity to keep a register of information on its ICT contracts, run pre-contract due diligence, and include specific contractual clauses on access, audit, exit, and sub-outsourcing (ESMA).
How does DORA show up for a SaaS selling into EU finance?
Any SaaS supplying ICT services to in-scope EU financial entities now sees DORA contract clauses and register-of-information requests in procurement.
Most teams over-invest in negotiating DORA wording on initial contracts and under-invest in keeping the register-of-information data clean across renewals. The asks slot into existing TPRM and SIG review cycles, often alongside SOC 2 and ISO 27001 artifacts.
Related terms
These adjacent terms cover the EU regulatory neighbors and vendor-review artifacts that travel with DORA in any European financial deal cycle.
- NIS2 - the EU directive on cybersecurity for essential and important entities, parallel to DORA in finance
- CTPP - the DORA designation for a critical ICT third-party provider directly overseen by the ESAs
- TPRM - the broader vendor-risk discipline DORA's third-party pillar formalizes for finance
- ISO 27001 - the ISMS standard DORA-regulated firms most often point to as their ICT control baseline