Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

Framework

DORA – Digital Operational Resilience Act (EU) 2022/2554

DORA has applied since 17 January 2025 to banks, insurers, payment service providers and other financial entities, and through their contracts it also affects their IT, cloud and software providers. Complass guides both sides: from ICT risk management to the requirements matrix of your financial customers.

Try for free Request a demo
Still from the short video “Compliance management in 20 seconds”
Compliance management in 20 seconds Project, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.

What is DORA?

DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It lays down uniform rules on ICT risk management, the classification and reporting of major ICT-related incidents, digital operational resilience testing, the management of ICT third-party risk including the register of information and contract contents, and the oversight of critical ICT third-party service providers. Delegated and implementing regulations of the Commission set out the details.

Content as of:

Does it apply to me?

DORA applies directly to financial entities under Art. 2, such as credit institutions, payment and e-money institutions, investment firms, management companies, insurance and reinsurance undertakings and crypto-asset service providers. In Germany, § 1a(2) KWG, § 1a(2a) KWG (reporting obligations since 17 January 2025, otherwise from 1 January 2027) and § 293(5) VAG extend the scope. Reliefs apply to microenterprises and to entities in the simplified framework under Art. 16. For financial entities DORA takes precedence over NIS2 as the more specific act, insofar as DORA contains equivalent requirements (Art. 4 NIS2 Directive).

IT, cloud, software and managed service providers are affected indirectly as ICT third-party service providers: their financial customers remain fully responsible and must require contract contents under Art. 30, audit and access rights, assistance with incidents, participation in tests and exit arrangements from them. A dedicated phase in the module guides providers through these requirements.

This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.

Legal basis

  • Art. 2 DORAArticle 2 DORA Scope1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities: - (a) credit institutions; - (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366; - (c) account information service providers; - (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC; - (e) investment firms; - …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Scope
  • Art. 3 DORAArticle 3 DORA DefinitionsFor the purposes of this Regulation, the following definitions shall apply: (1) ‘digital operational resilience’ means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Definitions, including ICT services and critical or important function
  • Art. 5 DORAArticle 5 DORA Governance and organisation1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience. 2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Governance and responsibility of the management body
  • Art. 16 DORAArticle 16 DORA Simplified ICT risk management framework1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Simplified ICT risk management framework
  • Art. 19 DORAArticle 19 DORA Reporting of major ICT-related incidents and voluntary notification of significant cyber threats1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Reporting of major ICT-related incidents
  • Art. 28 DORAArticle 28 DORA General principles1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: - (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗ICT third-party risk and register of information
  • Art. 30 DORAArticle 30 DORA Key contractual provisions1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format. 2. The contractual arrangements on the use …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Key contractual provisions
  • Art. 5 DelVO (EU) 2025/301Article 5 Delegated Regulation (EU) 2025/301 Time limits for the initial notification, and for the intermediate and final reports1. Financial entities shall submit the initial notification and the intermediate and final reports as referred to in Article 19(4), points (a), (b) and (c), of Regulation (EU) 2022/2554 within the following time limits: - (a) for the initial report: as early as possible, but in any case, within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours …As of: 06.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Time limits for initial notification, intermediate and final report

Key dates

  1. Entry into force of the Regulation · Art. 64Article 64 DORA Entry into force and applicationThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 17 January 2025.As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
  2. DORA applies in all EU Member States · Art. 64Article 64 DORA Entry into force and applicationThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 17 January 2025.As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
  3. First submission of the register of information to BaFin (as of 31.03.2025) · Art. 28(3)
  4. End of the 2026 submission period for the register of information to BaFin (09–30.03.2026, reference date 31.12.2025) · Art. 28(3)
  5. DORA applies to further KWG institutions under § 1a(2a) KWG (except Chapter III, which has applied since 17.01.2025) · § 65a(3) KWG

The reporting deadlines for major incidents are short: initial notification within four hours of classification as major, at the latest 24 hours after becoming aware (Art. 5 of Delegated Regulation (EU) 2025/301). The intermediate report follows at the latest 72 hours after the initial notification, the final report at the latest one month after the intermediate report or the latest updated intermediate report (Art. 5(1)(b) and (c) of Delegated Regulation (EU) 2025/301). Financial entities submit the register of information to BaFin annually; check BaFin's current dates each year.

How Complass helps

  • 8phases
  • 36guided steps
  • 18document templates
  • 107requirements in the catalogue

  • Guided DORA project

    Eight phases from applicability and role through governance, protection, incidents and testing to third-party risk and regular review; every step states whether it applies to financial entities, ICT providers or both.

  • Requirements catalogue by article

    The requirements of Art. 5 to 30 and 45 at paragraph level with original wording, status and evidence, supplemented by the customer requirements from the ICT provider's point of view.

  • Templates

    Framework document, resilience strategy, information security policy, reporting and classification plan, testing programme, register of information, contract review under Art. 30, exit plan and, for providers, requirements matrix, register information and incident notification.

  • Document third parties and incidents

    Keep the register of information, the contract review under Art. 30 and the exit plan as templates in the project and document incidents with timestamps in the incident register. For major ICT-related incidents the DORA reporting track calculates the deadlines for the initial notification, the intermediate report and the final report and prepares the mandatory information. You classify your ICT third-party service providers in Supplier Management and keep their contracts, evidence and questionnaires there.

The phases in the module

  1. Applicability, role and relationship to NIS2
  2. Governance and ICT risk management framework
  3. Protect, detect, respond, recover
  4. ICT-related incidents: management, classification, reporting
  5. Digital operational resilience testing
  6. ICT third-party risk
  7. Meeting the DORA requirements of your financial customers as an ICT third-party service provider
  8. Information sharing, evidence, effectiveness and improvement

Catalogue: DORA requirements catalogue by chapter and article

Matching modules

Compliance management

Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.

Learn more

Risk management

Risk register with qualitative or quantitative assessment, risk appetite and treatment plan, linked to assets, vulnerabilities and incidents.

Learn more

Incident management

Record incidents, check reporting obligations under NIS2, the CRA and the GDPR and track the reporting deadlines with a countdown.

Learn more

DORA in Complass: what you need at a minimum

The first selection covers the obligations in Complass if they apply to you. The free applicability check shows whether they do. To the applicability check

What you need at a minimum

If DORA applies to you: this selection covers the resulting obligations in Complass. It is preselected when you start a trial or order.

Portal size Start

Price of the minimum selection
ItemNet price per month
Start S€179
DORAincluded
Business continuity management (BCM)€79
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)included
Total€258 net/month

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.

Try free for 14 days: minimum selection DORA Order: minimum selection DORA

Adjust the selection in the price overview: minimum selection DORA

Recommended for more impact Offer, not a duty

Business with Supplier Management

More impact with Risk management and Supplier Management, room for 10 users and 2 frameworks.

€548 net/month, €290 more than the minimum selection.

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.

Try with Business: minimum selection DORA

View in the price overview: minimum selection DORA

Good to know: You can also meet the obligations without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information

Frequently asked questions

We are an IT service provider, not a financial entity. Does DORA affect us?

Yes, indirectly, if you provide ICT services to financial entities. Your customers must agree the contract contents under Art. 30 with you and require information for their register of information, assistance with incidents, audits and exit arrangements. Direct oversight only applies to critical ICT third-party service providers under Art. 31.

Does DORA or NIS2 apply to us?

For financial entities DORA is the more specific act; § 28(6) BSIG exempts them from central NIS2 obligations. ICT providers, on the other hand, may fall under NIS2 themselves and additionally have to meet their customers' DORA requirements. The applicability check in Complass covers the NIS2 side.

Does Complass submit reports to BaFin?

No. Complass helps you document incidents with timestamps, justify the classification as major with check questions, calculate the reporting deadlines and prepare the reports with their mandatory information. You submit the report yourself via the channel prescribed by the supervisor; the legal assessment of the individual case remains with you.

Where do we keep software licences and maintenance contracts for the register of information?

In the “Contracts and licences” register of asset management, with term, notice period, owners, linked assets and evidence; with supplier management also on the provider concerned. It provides information for your register of information under Art. 28 DORA; Complass does not offer an export in the format of Implementing Regulation (EU) 2024/2956.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo