DORA deadlines: dates and news on the Digital Operational Resilience Act
DORA sets digital operational resilience rules for banks, insurers, investment firms, payment institutions and other financial entities, and has applied since 17 January 2025. Every entry names its source and says whether it is binding law or guidance.
Coming up
Germany: annual register of information due at BaFin
BaFin asks supervised firms to complete the submission of their register of information through its MVP portal by 31 March each year, showing the state on 31 December of the previous year. A submission only counts once both BaFin and the ESAs have validated it. No taxonomy changes are planned for the 2027 cycle.
Commission review of DORA due
By this date the Commission reports on DORA after consulting the ESAs and the ESRB, with a legislative proposal where appropriate (Art. 58(1)). The review covers at least the criteria for designating critical providers, voluntary notification of significant cyber threats, the EU subsidiary rule for critical providers from third countries and the oversight network.
2026
ESAs statement on ICT risks from frontier AI models
Statement JC 2026 25 says frontier AI models speed up the discovery and exploitation of vulnerabilities and that supervisors will pay particular attention to how financial entities safeguard operational resilience, including closing open ICT findings without delay. A supervisory statement, not new law.
ESRB warns of systemic cyber risk from frontier AI models
Warning ESRB/2026/3 of the European Systemic Risk Board on systemic cyber risks stemming from frontier AI models, published in the Official Journal. A warning, not binding law; the ESAs followed with a supervisory statement on 31 July 2026.
First annual report on major ICT incidents: 3,383 in 2025
The ESAs' report under Art. 22(2) counts 3,383 major ICT-related incidents reported across the EU financial sector in 2025, an average of 0.18 per financial entity under DORA, most of them in the credit and payments sectors. Anonymised and aggregated; a report, not guidance.
2025
ESAs report on whether statutory auditors should come under DORA
Joint report JC 2025 85, answering the Commission's review under Art. 58(3), weighs bringing statutory auditors and audit firms into DORA's scope. It notes that audits are not part of the auditee's operational value chain and that inclusion could raise audit fees and market concentration. A report, not law; published 17 December 2025.
ESAs designate the first critical ICT third-party providers
EBA, EIOPA and ESMA publish the list of designated critical ICT third-party providers (CTPPs), based on the registers of information and a criticality assessment with the national authorities. Designated providers come under direct EU oversight; financial entities stay responsible for their own ICT third-party risk.
Rules on subcontracting ICT services for critical functions enter into force
Delegated Regulation (EU) 2025/532 of 24 March 2025 requires a financial entity to decide before contracting whether a provider may subcontract ICT services that support critical or important functions, to set the conditions in the contract and to be told of material changes (Art. 30(5)). It is binding.
Rules for threat-led penetration testing (TLPT) enter into force
Delegated Regulation (EU) 2025/1190 of 13 February 2025 sets which financial entities must run TLPT and how: identification criteria, an active red team phase of at least 12 weeks, closure, remediation plan and attestation (Art. 26(11)). TLPT applies only to entities the authority identifies, never to microenterprises.
First registers of information due at the ESAs
Deadline set by the ESAs' Decision for national competent authorities to report the registers of information they collected from financial entities. The data was used for the first designation of critical ICT third-party providers.
Rules on the joint examination teams for critical providers enter into force
Delegated Regulation (EU) 2025/420 of 16 December 2024 sets the composition and tasks of the joint examination team that assists the Lead Overseer for each critical ICT third-party provider (Art. 40, 41(1)(c)). It is binding.
Content, deadlines and forms for major incident reports enter into force
Delegated Regulation (EU) 2025/301 sets the content and time limits of incident reports: initial notification within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware, intermediate report within 72 hours, final report within one month (Art. 5(1)). Implementing Regulation (EU) 2025/302 sets the forms. Both were adopted on 23 October 2024 and are binding.
Rules on conducting the oversight of critical providers enter into force
Delegated Regulation (EU) 2025/295 of 24 October 2024 harmonises how the oversight of critical ICT third-party providers is conducted, including the information a provider submits to opt in to designation (Art. 41(1)(a), (b), (d)). It is binding.
DORA applies
From this date the Regulation applies in full (Art. 64): ICT risk management, incident reporting, resilience testing, ICT third-party risk and the oversight of critical providers. There is no further transition period for financial entities.
Transposition deadline for the DORA amending Directive
By this date Member States had to adopt, publish and apply the national measures for Directive (EU) 2022/2556 (Art. 9), which links the banking, insurance, investment and payment directives to DORA's requirements.
2024
Germany publishes its Financial Market Digitalisation Act (FinmadiG)
BGBl. 2024 I Nr. 438 adapts German supervisory law to DORA and to the crypto-asset rules (MiCA), amending among others the Banking Act (KWG), the Securities Trading Act (WpHG) and the Investment Code (KAGB). Most of it applies from 30 December 2024. DORA itself applies directly and needs no national law; the Act settles supervision and the national rules around it.
Templates for the register of information enter into force
Implementing Regulation (EU) 2024/2956 of 29 November 2024 fixes the standard templates for the register of information that every financial entity, microenterprises included, keeps on all its contracts for ICT services (Art. 28(3), (9)). It is binding.
ESAs set 30 April 2025 for the first registers of information
The ESAs publish a Decision (dated 8 November 2024) requiring national competent authorities to pass on the financial entities' registers of information on ICT contracts by 30 April 2025. The registers feed the designation of critical ICT third-party providers; each authority sets its own earlier collection date.
First DORA technical standards enter into force: ICT risk framework, incident classification, third-party policy
Three Delegated Regulations adopted on 13 March 2024: (EU) 2024/1774 on ICT risk management tools and the simplified framework (Art. 15, 16), (EU) 2024/1772 on classifying ICT incidents and significant cyber threats (Art. 18(3)), and (EU) 2024/1773 on the policy for ICT services that support critical or important functions (Art. 28(10)). They bind financial entities from 17 January 2025.
Delegated Regulations on critical provider criteria and oversight fees enter into force
Delegated Regulation (EU) 2024/1502 sets the criteria for designating ICT third-party service providers as critical for financial entities (Art. 31(6)); Delegated Regulation (EU) 2024/1505 sets the oversight fees the Lead Overseer charges them (Art. 43(2)). Both were adopted on 22 February 2024 and are binding.
2023
DORA enters into force
Under Article 64 the Regulation enters into force on the twentieth day after publication. Its obligations apply from 17 January 2025, which left two years for the technical standards and for firms to prepare.
2022
DORA and its amending Directive are published in the Official Journal
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector and Directive (EU) 2022/2556, which aligns eight financial services directives with it, appear in OJ L 333 of 27 December 2022. Both were signed on 14 December 2022.
Sources
4
This page is regularly updated from the following official and journalistic sources.
¿Le han encargado NIS2?
Le guiamos paso a paso. Usted rellena, nosotros explicamos cada punto con palabras sencillas y, al final, firma la dirección.
