What Is DORA? The EU Digital Operational Resilience Act Explained — 20 Entity Types, 19 Critical Tech Providers, and Where NIS2 Still Applies

DORA is Regulation (EU) 2022/2554, the Digital Operational Resilience Act. It has applied since 17 January 2025 and gives the EU financial sector one rulebook for technology risk: how firms manage ICT risk, report major incidents, test their resilience, control their technology suppliers and share threat intelligence. It covers 20 types of financial entity, from banks to crowdfunding platforms, and it puts the biggest technology suppliers to finance under direct EU oversight. Nineteen of them were named on 18 November 2025.

The link to NIS2 is narrower than most summaries suggest. For financial entities, DORA takes the place of NIS2’s risk-management and incident-reporting rules. But NIS2’s annexes only ever listed three of DORA’s 20 entity types. And many of the cloud, telecoms and data-centre companies DORA now oversees are NIS2 entities in their own right. This guide walks through all three situations, article by article.

Who DORA Applies To: 20 Financial Entity Types Plus Their ICT Providers

In plain terms: if you hold an EU financial licence, DORA almost certainly applies to you. If you sell technology to a firm that holds one, DORA reaches you through that firm’s contracts. If you are one of the largest suppliers, it reaches you through direct supervision as well.

Article 2(1) of Regulation (EU) 2022/2554 lists entities (a) to (u). Points (a) to (t) are the “financial entities” (Article 2(2)); point (u) covers ICT third-party service providers. When we lined that list up against Annex I of the NIS2 Directive (EU) 2022/2555, only three of the twenty financial entity types appeared in it.

Group	DORA Article 2(1) points	Also listed in NIS2 Annex I?
Banking and payments	(a) credit institutions; (b) payment institutions; (c) account information service providers; (d) e-money institutions	Credit institutions only (point 3, Banking)
Investment and market infrastructure	(e) investment firms; (f) crypto-asset service providers and issuers of asset-referenced tokens; (g) central securities depositories; (h) central counterparties; (i) trading venues; (j) trade repositories; (m) data reporting service providers	Central counterparties and operators of trading venues only (point 4)
Funds	(k) managers of alternative investment funds; (l) management companies	No
Insurance and pensions	(n) insurance and reinsurance undertakings; (o) insurance, reinsurance and ancillary insurance intermediaries; (p) institutions for occupational retirement provision	No
Other market services	(q) credit rating agencies; (r) administrators of critical benchmarks; (s) crowdfunding service providers; (t) securitisation repositories	No
Technology suppliers	(u) ICT third-party service providers	Not as a category, but cloud, data-centre, telecoms and managed-service providers are listed in points 8 and 9

Two carve-outs narrow the list. Article 2(3) takes six categories out of DORA entirely, including small alternative investment fund managers, small insurers, pension schemes with no more than 15 members and insurance intermediaries that are micro, small or medium-sized enterprises. Our Article 2(3) exemption breakdown lists all six and the obligations that still apply to them. Article 2(4) is different. It lets each Member State exclude specific national institutions named in the Capital Requirements Directive, such as development banks and credit unions. That difference matters later, because NIS2 refers to only one of the two.

For the firms that stay in scope, DORA scales. Article 4 requires the ICT risk rules to be applied in proportion to size, risk profile and complexity. Article 16 gives small and non-interconnected investment firms, exempted payment and e-money institutions and small pension institutions a lighter, simplified ICT risk-management framework. Microenterprises are spared the formal testing programme in Article 24(1).

How DORA Relates to NIS2: Three Different Answers

In plain terms: DORA replaces NIS2’s security and reporting rules only for financial entities that NIS2 covers. Most DORA entities were never covered by NIS2, so for them there is nothing to replace. ICT providers can be covered by both laws at once.

The legal hinge sits in DORA, not in NIS2. Article 1(2) of DORA states that, for financial entities identified as essential or important under national rules transposing Article 3 of NIS2, DORA “shall be considered a sector-specific Union legal act for the purposes of Article 4” of NIS2. NIS2 Article 4(1) then switches off “the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII”. Recital 28 of NIS2 explains the intent: DORA’s rules on ICT risk, incident reporting, testing, information sharing and third-party risk “should apply instead”. As a recital, though, it explains the purpose. The binding switch is the Article 1(2) and Article 4 pair.

1. Banks, trading venues and CCPs: DORA replaces, NIS2 lingers

These are the only DORA entities NIS2 ever listed. DORA Article 1(2) presupposes they stay identified under NIS2, so that status survives the displacement, and national law can attach duties to it. Poland is one example: DORA covers Polish banks, but KNF still requires a NIS2 registration step. DORA also lets Member States require copies of major-incident reports to go to NIS2 authorities or CSIRTs (Article 19(1), last subparagraph), so a bank may end up reporting one incident to two recipients. For the banking activities that fall between the two regimes, see why DORA doesn’t cover all banking.

2. The other seventeen: DORA is the whole EU story

Insurers, investment firms, payment institutions, fund managers and the rest were never in NIS2’s Annex I. For them there is no NIS2 obligation to displace: at EU level, DORA is their cyber regime. One caveat: national transposition laws can add sectors, so confirm with your national NIS2 authority before treating that as settled. Our fintech scope guide works through payment, e-money and crypto firms case by case.

3. ICT providers: both laws, side by side

DORA Article 1(2) only covers financial entities. It does nothing for a cloud provider, which can be an essential entity under NIS2 (Annex I, point 8) and a critical provider under DORA at the same time. Both texts plan for that overlap. NIS2 Articles 32(10) and 33(6) require NIS2 authorities to inform DORA’s Oversight Forum when they supervise an entity that is also a designated critical ICT provider. DORA Article 47 lets financial supervisors ask to join the NIS2 Cooperation Group’s work on exactly those entities.

One trap catches many readers. NIS2 Article 2(10) removes from NIS2 only the entities a Member State has exempted under DORA Article 2(4). Falling outside DORA under Article 2(3) gives you nothing under NIS2. For a control-by-control comparison of the two regimes, see our DORA vs NIS2 analysis.

What DORA Requires: Five Pillars, Mapped to the Articles

In plain terms: DORA has five sets of obligations, each in its own chapter. The regulation states the principle; delegated and implementing acts set the detailed rules.

Pillar	Where in DORA	Core obligation
ICT risk management	Chapter II, Articles 5–16	A “sound, comprehensive and well-documented” ICT risk-management framework (Article 6(1)), owned by the management body; a simplified version under Article 16
Incident management, classification and reporting	Chapter III, Articles 17–23	Classify ICT-related incidents and report major ones to the competent authority (Article 19)
Digital operational resilience testing	Chapter IV, Articles 24–27	A risk-based testing programme for all but microenterprises; threat-led penetration testing (TLPT) at least every 3 years for entities identified by the supervisor (Article 26(1))
ICT third-party risk	Chapter V, Articles 28–44	A register of information covering every ICT contract (Article 28(3)), minimum contract terms (Article 30), and EU oversight of critical providers (Articles 31–44)
Information sharing	Chapter VI, Article 45	Financial entities “may” share threat intelligence within trusted communities, so this pillar is voluntary

The detail sits below the regulation. EIOPA’s DORA page sets out three levels: Level 1 is the regulation plus amending Directive (EU) 2022/2556; Level 2 is a dozen technical standards and delegated acts (risk framework, incident classification and reporting, TLPT, subcontracting, the register of information, oversight fees); Level 3 is guidelines and Q&As. Reading only the 64 articles misses most of the operational detail. The reporting deadlines in the next section are one example: DORA itself states none of those hours.

For the board: Article 5(2) says the management body must “bear the ultimate responsibility” for ICT risk. It must also approve the digital operational resilience strategy, the ICT business continuity policy, ICT audit plans and the policy on third-party ICT services, and allocate the budget for all of them. Article 5(4) requires members to keep their ICT-risk knowledge current, including through regular training. NIS2 Article 20(1) adds a sentence DORA’s Article 5 lacks: management bodies “can be held liable”. DORA reaches individuals through national penalty rules instead (see the penalties section below).

For the CISO: TLPT is the steepest step up, because NIS2 contains no threat-led testing obligation. Our red-team testing guide covers how TIBER-EU and the TLPT standards work in practice.

The Major-Incident Clock: Four Hours From Classification, 24 From Awareness

In plain terms: DORA’s first report is due faster than NIS2’s, but the clock starts at a different moment. It starts when you classify the incident as major, not when you discover it.

Article 19(4) of DORA requires an initial notification, an intermediate report and a final report, but leaves the deadlines to technical standards. Those deadlines are in Article 5 of Commission Delegated Regulation (EU) 2025/301.

Stage	DORA (Delegated Regulation 2025/301, Art. 5)	NIS2 (Article 23(4))
What starts the clock	An ICT-related incident classified as major	Becoming aware of a significant incident
First report	Initial notification within 4 hours of classification, and no later than 24 hours after becoming aware	Early warning within 24 hours of becoming aware
Second report	Intermediate report within 72 hours of the initial notification	Incident notification within 72 hours of becoming aware
Final report	No later than one month after the latest intermediate report	No later than one month after the incident notification

The practical consequence: under DORA, your classification procedure is the control that matters. If an incident is only recognised as major after the first day, Article 5(2) gives four hours from that later classification, and a supervisor will want to know why it took so long. Record when and why each incident was classified. Our NIS2 incident reporting guide covers the NIS2 side of the comparison.

Change has been proposed but not agreed. The Commission’s Digital Omnibus proposal, COM(2025) 837, would send DORA, NIS2, GDPR, eIDAS and CER incident reports through one ENISA-run entry point. Its recitals also ask the Commission to take due account of DORA’s reporting standards when it sets the other formats, which makes DORA’s templates the likely model for the rest. Law firm Jones Day expects the portal within 18 months of the Omnibus entering into force. The Parliament’s procedure file 2025/0360(COD) still shows it awaiting a committee decision, so today’s rules stand.

Critical ICT Third-Party Providers: The 19 Names, and Why NIS2 Is Involved

In plain terms: the EU now supervises some technology suppliers directly because so many banks and insurers rely on the same few providers.

On 18 November 2025 the three European Supervisory Authorities announced the first designations under Article 31. Their starting data was the registers of information that financial entities must keep under Article 28(3). The published list names 19 providers: Accenture, Amazon Web Services EMEA, Bloomberg, Capgemini, Colt Technology Services, Deutsche Telekom, Equinix (EMEA), Fidelity National Information Services, Google Cloud EMEA, IBM, InterXion HeadQuarters, Kyndryl, LSEG Data and Risk, Microsoft Ireland Operations, NTT DATA, Oracle Nederland, Orange, SAP and Tata Consultancy Services.

Each one gets a Lead Overseer: whichever of the EBA, EIOPA or ESMA supervises the financial entities holding the largest share of total assets among the provider’s customers (Article 31(1)(b)). Article 31(9) requires the list to be updated every year. Article 31(8) keeps certain providers off it, including intra-group providers and those whose financial-sector customers all operate in a single Member State.

Read the list by business line and the NIS2 overlap is clear. By our reading of their main services, it includes hyperscale cloud, data centres, telecoms networks and large managed-IT providers, all service types NIS2 Annex I lists in points 8 and 9. Whether each named legal entity is registered under NIS2 depends on national registration, but this is the case NIS2 Articles 32(10) and 33(6) were written for. Suppliers not on the list still feel DORA through Article 30, which sets the minimum terms of every ICT contract with a financial entity.

Penalties: DORA Sets No EU Fine Ceiling for Financial Entities

In plain terms: NIS2 sets minimum maximum fines. DORA leaves fines to each Member State, except for critical providers, which face an EU-level penalty set as a share of daily turnover.

Who	Rule	Amount
Financial entities	DORA Article 50(3)–(4): Member States set administrative penalties that are “effective, proportionate and dissuasive”, with minimum powers such as cease-and-desist orders and public notices	No EU figure; set in national law. Under Article 52, breaches already covered by national criminal law can be left to it
Management body members	DORA Article 50(5)	Penalties can extend to individuals, subject to national law
Critical ICT providers	DORA Article 35(6)–(8): periodic penalty payment by the Lead Overseer for non-compliance	Up to 1% of average daily worldwide turnover, charged daily for up to six months
NIS2 essential / important entities (for comparison)	NIS2 Article 34(4)–(5)	Maximum of at least €10 million or 2% / €7 million or 1.4% of worldwide annual turnover

The 1% is charged per day, so the arithmetic is smaller than it sounds: six months at the maximum rate comes to roughly 1.8 days of worldwide revenue, about 0.5% of a year’s turnover. The extra pressure comes from publicity. Article 35(10) requires the Lead Overseer to publish every periodic penalty payment it imposes.

Key Dates and What to Do Now, by Role

Date	Event
27 December 2022	DORA published in the Official Journal (OJ L 333)
16 January 2023	Entry into force (20th day after publication, Article 64)
17 January 2025	DORA applies in full, directly in every Member State
18 November 2025	First list of 19 critical ICT third-party providers
19 November 2025	Digital Omnibus proposed (single reporting entry point); still in the legislative process
Yearly	Critical-provider list updated (Article 31(9))

• Compliance officer at a financial entity: confirm whether Article 2(3) or the Article 16 simplified regime applies. Ask your authority whether DORA incident reports must also go to the NIS2 CSIRT (Article 19(1)) and whether national NIS2 registration duties remain.
• CISO at an ICT provider: assess NIS2 status on its own terms (Annex I points 8–9 and size), and expect Article 30 clauses in your financial customers’ contracts.
• Board members: date-stamp each Article 5(2) approval and keep evidence of the training required by Article 5(4).

Does DORA, NIS2, or Both Apply to You?

1. Do you hold one of the licences in DORA Article 2(1)(a)–(t)? If no, go to step 4. If yes, go to step 2.
2. Does Article 2(3) exclude you? If yes, DORA does not apply, and NIS2 applies only if your entity type appears in NIS2’s annexes and you meet its size threshold. If no, go to step 3.
3. Are you a credit institution, trading-venue operator or central counterparty? If yes, DORA governs your ICT risk management and incident reporting, while your NIS2 status and any national residual duties may remain. If your Member State exempted you under Article 2(4), you are outside both. If you are none of the three, DORA is your EU regime.
4. Do you provide ICT services to financial entities? If yes, DORA reaches you through contracts, and possibly through direct oversight. Check NIS2 Annex I points 8–9 separately, because if you qualify there, both regimes apply. If no, DORA does not reach you by this route.

Frequently Asked Questions

Is DORA a regulation or a directive?

A regulation. Article 64 makes it “binding in its entirety and directly applicable in all Member States”, so the rules themselves need no national transposition. Penalties are the exception: Article 50 leaves them to national law. A companion Directive, (EU) 2022/2556, amended existing financial-services directives so they line up with DORA.

Does DORA replace NIS2 for banks?

For ICT risk management, incident reporting and the related supervision, yes, through DORA Article 1(2) and NIS2 Article 4(1). The NIS2 identification itself remains, and Member States can keep national duties tied to it or require dual incident reporting under DORA Article 19(1).

Does DORA apply to ICT providers that are not on the critical list?

Not directly as supervised entities. It reaches them through their financial-sector customers, who must keep a register of every ICT contract and include the Article 30 minimum terms. Separately, NIS2 may apply to the provider directly.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

How This Guide Was Verified

Every article, recital and annex number above was checked against the official English texts on EUR-Lex, not against secondary commentary. We retrieved the full texts of DORA, NIS2 and Delegated Regulation 2025/301, stripped the markup and searched them directly. That is how we confirmed that NIS2’s annexes name only three of DORA’s twenty entity types, that DORA’s own articles state no reporting hours, and that NIS2 contains no threat-led testing obligation. The list of critical providers is taken verbatim from the ESAs’ published PDF. Where a point rests on a recital or a legislative proposal rather than binding law, the text says so.

Sources

1. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) — EUR-Lex (Articles 1–2, 4–6, 16, 19, 24, 26, 28, 30, 31, 35, 45, 47, 50, 52, 64)
2. Directive (EU) 2022/2555 (NIS2) — EUR-Lex (Recital 28; Articles 2(10), 4, 20, 23, 32(10), 33(6), 34; Annex I)
3. Commission Delegated Regulation (EU) 2025/301 on the content and time limits of major ICT-related incident reports — EUR-Lex (Article 5)
4. European Supervisory Authorities, press release on the designation of critical ICT third-party providers, 18 November 2025 — EBA
5. List of designated critical ICT third-party service providers (Article 31(9) DORA) — EBA (PDF)
6. Digital Operational Resilience Act (DORA): Level 1, 2 and 3 texts — EIOPA
7. Proposal for a Regulation on the simplification of the digital legislative framework (Digital Omnibus), COM(2025) 837 — EUR-Lex
8. Procedure file 2025/0360(COD), Digital Omnibus — European Parliament Legislative Observatory
9. EU Digital Omnibus: How EU Data, Cyber, and AI Rules Will Shift — Jones Day, December 2025