{"id":48828,"date":"2026-06-08T14:29:37","date_gmt":"2026-06-08T11:29:37","guid":{"rendered":"https:\/\/trueconf.com/blog\/?p=48828"},"modified":"2026-08-31T18:01:59","modified_gmt":"2026-08-31T15:01:59","slug":"dora-regulation","status":"publish","type":"post","link":"https:\/\/trueconf.com/blog\/reviews-comparisons\/dora-regulation","title":{"rendered":"Digital Operational Resilience Act (DORA) Explained 2026"},"content":{"rendered":"

The Digital Operational Resilience Act (DORA)<\/em>, Regulation (EU) 2022\/2554, establishes EU-wide requirements for the digital operational resilience of financial entities. It covers ICT risk management, major ICT-related incident reporting, resilience testing, ICT third-party risk, and voluntary information sharing, with additional oversight applying to designated critical ICT third-party service providers.<\/p>\n

DORA has applied since 17 January 2025. As an EU regulation, it is directly applicable across Member States, while supervision and sanctions are carried out by the competent authorities identified under DORA and relevant national frameworks.<\/p>\n

DORA places responsibility for the ICT risk-management framework on the management body of the financial entity, making digital operational resilience a governance responsibility rather than an IT-only issue.<\/p>\n

Communication infrastructure<\/a> can form part of this framework when it supports financial services, incident response, or critical or important functions.<\/p>\n

Article 14 of DORA<\/a> requires financial entities to maintain crisis communication plans for responsible disclosure of major ICT-related incidents or vulnerabilities to clients, counterparts, and the public as appropriate. Communication channels used for crisis coordination should therefore be assessed within the institution’s ICT risk and continuity planning.<\/p>\n

DORA does not automatically classify every communication platform as critical infrastructure. The applicable controls depend on how the platform is used, whether it supports a critical or important function, and whether it is provided under a contractual arrangement with an ICT third-party service provider.<\/p>\n

Key Takeaways at a Glance<\/h3>\n\n\n\n\n\n\n\n\n\n
\n

Question<\/strong><\/p>\n<\/th>\n

\n

Direct answer<\/strong><\/p>\n<\/th>\n<\/tr>\n

\n

What DORA is?<\/strong><\/p>\n<\/td>\n

\n

Regulation (EU) 2022\/2554, a directly applicable EU law requiring financial entities to manage ICT risk, report major ICT-related incidents, test resilience, and manage ICT third-party risk; it also establishes an oversight framework for designated critical ICT third-party service providers<\/p>\n<\/td>\n<\/tr>\n

\n

When it entered into force and became applicable?<\/strong><\/p>\n<\/td>\n

\n

Entered into force 16 January 2023, fully applicable across the EU since 17 January 2025<\/p>\n<\/td>\n<\/tr>\n

\n

Who does DORA apply to?<\/strong><\/p>\n<\/td>\n

\n

The financial entities listed in Article 2, including banks, insurers, investment firms, payment institutions, electronic money institutions, and certain crypto-asset market participants. ICT third-party service relationships are governed through separate DORA third-party risk requirements<\/p>\n<\/td>\n<\/tr>\n

\n

Five core areas commonly used to summarize DORA<\/strong><\/p>\n<\/td>\n

\n

ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing arrangements<\/p>\n<\/td>\n<\/tr>\n

\n

Current implementation and oversight status<\/strong><\/p>\n<\/td>\n

\n

DORA has applied since 17 January 2025. The ESAs published the first list of designated Critical ICT Third-Party Providers on 18 November 2025 and the oversight framework is operational<\/p>\n<\/td>\n<\/tr>\n

\n

Why communications infrastructure matters here?<\/strong><\/p>\n<\/td>\n

\n

Video conferencing and messaging platforms<\/a> should be included in DORA scoping when they are used as ICT services by a financial entity. Enhanced requirements apply where an ICT service supports a critical or important function<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Understanding DORA’s Regulatory Architecture and Jurisdictional Reach<\/h2>\n

\"Data<\/p>\n

Unlike a directive, DORA does not require transposition into national law to become applicable. Its core requirements apply directly across the EU, although national competent authorities remain responsible for supervision and Member States provide the applicable national rules for penalties and remedial measures where DORA requires them.<\/p>\n

The regulation is intended to harmonize ICT risk-management and digital operational resilience requirements across the EU financial sector.<\/p>\n

DORA’s scope encompasses an extensive range of financial entities, including:<\/b><\/p>\n

\n