DORA explained for non-financial companies
The DORA regulation is the EU law that requires banks, insurers and other financial entities to withstand, respond to and recover from technology failures. However, it is not just «a bank thing». In fact, if your company provides technology services to a financial entity, its requirements will reach you through the contract.
In 30 seconds: the DORA regulation has applied since 17 January 2025 to 20 types of financial entity. It also rests on five pillars: ICT risk, incidents, testing, third parties and information sharing. Therefore, if you are an ICT provider, your client will ask you for the Article 30 clauses. Finally, the most critical providers come under direct European oversight.
What the DORA regulation is, without jargon
DORA stands for Digital Operational Resilience Act. Today the financial system depends so heavily on technology that a serious IT failure can do as much damage as a liquidity crisis. That is why the law requires firms to prove that their technology holds up, rather than simply trusting that it will.
Its formal name is Regulation (EU) 2022/2554, and it entered into force on 16 January 2023. As an EU regulation, it needs no national transposition: it binds firms directly across the EU. In Spain, three supervisors enforce it within their own sectors: the Banco de España, the CNMV (securities markets) and the DGSFP (insurance and pension funds). In addition, the DORA regulation comes with technical standards on reporting, the register of providers and testing.
Who the DORA regulation applies to: the 20 types of entity
Article 2 lists 21 categories. The first 20, points (a) to (t), make up the «financial entities». By contrast, the last one, point (u), covers ICT third-party service providers. Here they are, grouped by sector:
| Sector | Entities covered (Art. 2(1)) |
|---|---|
| Banking and payments (4) | Credit institutions, payment institutions, account information service providers and electronic money institutions |
| Investment and markets (7) | Investment firms, central securities depositories, central counterparties, trading venues, trade repositories, data reporting service providers and securitisation repositories |
| Asset management (2) | Managers of alternative investment funds and management companies |
| Insurance and pensions (3) | Insurance and reinsurance undertakings, insurance intermediaries and institutions for occupational retirement provision |
| Crypto and crowdfunding (2) | Crypto-asset service providers and issuers of asset-referenced tokens; crowdfunding service providers |
| Ratings and benchmarks (2) | Credit rating agencies and administrators of critical benchmarks |
There are also exclusions. For example, Article 2(3) leaves out insurance intermediaries that are SMEs and occupational pension schemes with no more than 15 members in total. Likewise, the proportionality principle in Article 4 adapts the requirements to each firm’s size and risk profile.
Why it affects technology companies outside finance
The DORA regulation governs financial entities, but it makes them responsible for the ICT risk they outsource. In fact, under Article 28 the firm remains fully responsible even when it buys the service from outside. That is why your client needs to pass a large share of its obligations on to you through the contract.
What changes if you serve a bank or an insurer
In practice, you will notice four things. First, longer security questionnaires and audits before you sign or renew. Second, new contracts or addenda with the Article 30 clauses. Third, your company will appear in the register of information that your client sends to its supervisor. Finally, if your service supports a critical or important function, the bar rises sharply.
We also explain how the register of ICT third-party information works. If your clients are banks or insurers, see as well what supervisors expect from banking and fintech and from insurers.
The five pillars of the DORA regulation
- ICT risk management (Articles 5 to 16): a framework to identify, protect, detect, respond and recover, which the management body approves and oversees.
- Incidents (Articles 17 to 23): classify them and report the major ones to the supervisor.
- Resilience testing (Articles 24 to 27): an annual programme and, for the firms the supervisor selects, TLPT at least every three years.
- Third-party ICT risk (Articles 28 to 44): a provider policy, the register, minimum clauses, exit plans and oversight of critical providers.
- Information sharing (Article 45): voluntary arrangements to exchange cyber threat intelligence.
As for reporting deadlines, Delegated Regulation (EU) 2025/301 sets them. The initial notification goes within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. Then come the intermediate report, within 72 hours, and the final report, one month later.
For a technology provider, the pillars of the DORA regulation that weigh most are the fourth and the third. Also, the second affects you if a failure on your side causes a major incident, because your client will need data from you within hours. Finally, if advanced testing interests you, see how TLPT works.
What your client will ask for: the Article 30 clauses
Article 30 sets the minimum content of any ICT services contract with a financial entity. In addition, the whole contract, including service levels, must sit in a single written document.
Clauses for every ICT contract
- A description of the services and whether you may subcontract them.
- Locations where you deliver the service and process data, with advance notice of any change.
- Data protection: availability, authenticity, integrity and confidentiality.
- Return of the data if you go out of business or the contract ends.
- Service level descriptions.
- Incident assistance at no extra cost or at a cost agreed in advance.
- Cooperation with the client’s authorities.
- Termination rights and minimum notice periods.
- Participation in the client’s digital resilience training.
Extra clauses for critical or important functions
- Precise quantitative and qualitative service targets.
- Notice of any development that could affect your ability to deliver.
- Tested contingency plans and appropriate security measures.
- Cooperation in the client’s TLPT.
- Access, inspection and audit rights for the client and the supervisor.
- An exit strategy with a mandatory transition period.
Moreover, Delegated Regulation (EU) 2025/532, in force since July 2025, details what your client must assess if you subcontract part of a critical service. If you already hold ISO 27001, much of the evidence will exist; we cover it in why ISO 27001 works as a shortcut to several laws.
Critical providers (CTPPs): direct European oversight
Some providers matter so much to the sector that the European authorities oversee them directly. The EBA, EIOPA and ESMA designate them as critical ICT third-party providers (CTPPs) under Article 31. To do so, they mainly weigh their systemic impact and how hard they are to replace.
The authorities published the first list of CTPPs on 18 November 2025. Each one has a Lead Overseer, which can request information, carry out inspections and issue recommendations. If the provider does not comply, the Lead Overseer can impose daily penalty payments of up to 1% of its average daily worldwide turnover, for up to six months.
By contrast, if you are a small technology firm, designation is unlikely. Indeed, Article 31(8) excludes providers that serve only one Member State and only clients active in that state. Even so, the Article 30 clauses still apply to you.
Frequently asked questions about the DORA regulation
When did the DORA regulation start to apply?
On 17 January 2025. It entered into force in January 2023, but firms had two years to adapt.
Does DORA only affect banks?
No. It covers 20 types of financial entity, such as insurers, asset managers, payment institutions and crypto-asset service providers. It also reaches their ICT providers indirectly.
I supply an insurer. Do I have to comply with DORA?
The legal duty lies with your client. However, it can only comply if you accept the Article 30 clauses, allow audits and cooperate on incidents. In practice, either you adapt or staying on as its supplier gets hard.
How is the DORA regulation different from NIS2?
NIS2 is a cybersecurity directive for many sectors, whereas the DORA regulation is specific to the financial sector: it applies to financial entities and reaches their ICT third-party providers. So, for financial entities, DORA acts as the sector-specific law on ICT risk and incident reporting.
What if my firm is small?
Proportionality applies. For example, some small firms, such as small and non-interconnected investment firms, have a simplified ICT risk framework (Article 16). Others, such as insurance intermediaries that are SMEs, fall outside the scope.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with the DORA regulation
Atalaya GRC serves both financial entities and their technology providers. The platform shows what the law requires service by service, keeps the ICT third-party register and stores the evidence. In addition, with «one control, many regulations» you reuse work done for ISO 27001, NIS2 or GDPR. The regulatory clock warns you before each deadline, and incident management guides you through notifications. See our DORA guide or request a demo.
