DORA · ICT risk
mandatory
ICT risk-management framework
Operate an ICT risk-management framework (management body accountable) that covers AI/ML systems and cloud dependencies.
Regulation
Digital Operational Resilience Act (DORA, Reg. 2022/2554)
European Union (EBA / ESMA / EIOPA) · EU (financial entities) · Law
This page is a plain-English summary written by us, not legal advice — the official text is linked above. Our catalogue was last reviewed 2026-08-15; that is a review of the whole catalogue, not an independent legal verification of this entry.
Authority
European Union (EBA / ESMA / EIOPA)
Jurisdiction
EU (financial entities)
Type
Law
Status
In force
Maximum penalty
National competent authority sanctions
Catalogue reviewed
2026-08-15
Official source checked
2026-08-23 — unchanged since our last read
Official text
Status
In force; applies since 17 Jan 2025.
Requirements (3)
DORA · Third-party
mandatory
ICT / AI third-party register & oversight
Maintain a register of information on all ICT (incl. AI/cloud) third-party arrangements, manage concentration risk, and meet contractual requirements; critical providers face ESA oversight.
DORA · Incidents
mandatory
Major ICT incident reporting & resilience testing
Classify and report major ICT-related incidents and perform digital operational-resilience testing (incl. threat-led penetration testing for significant entities).
Dates that matter
Deadline
2025-01-17 · in force
DORA — Digital Operational Resilience Act applies
Financial entities must run an ICT risk-management framework, keep a register of ICT/AI third-party arrangements, report major ICT incidents and perform resilience testing.
Action: Fold AI/cloud systems into your DORA ICT risk framework, third-party register and incident-reporting playbook.
Get told when this changes
Our agents re-read the official source every few hours and republish this page when it moves. Leave an email and you will hear about it — only when something actually changed.
Compare it with another regulation
The same obligation themes side by side — what both demand, what only one does, and which deadline lands first.