DORA – Reglamento (UE) 2022/2554 sobre la resiliencia operativa digital

¿Me afecta?

DORA se aplica directamente a las entidades financieras conforme al art. 2, por ejemplo entidades de crédito, entidades de pago y de dinero electrónico, empresas de inversión, gestoras de activos, empresas de seguros y reaseguros y proveedores de servicios de criptoactivos. En Alemania amplían el círculo el § 1a, apdo. 2, KWG, el § 1a, apdo. 2a, KWG (obligaciones de notificación desde el 17 de enero de 2025, el resto a partir del 1 de enero de 2027) y el § 293, apdo. 5, VAG. Para las microempresas y las empresas sujetas al marco simplificado conforme al art. 16 se aplican facilidades. Para las entidades financieras, DORA prevalece sobre la regulación NIS2 como acto jurídico más específico, en la medida en que DORA contenga requisitos equivalentes (art. 4 de la Directiva NIS2).

Los proveedores de servicios de TI, nube, software y servicios gestionados se ven afectados de forma indirecta como terceros proveedores de servicios de TIC: sus clientes financieros siguen siendo plenamente responsables y deben exigirles contenidos contractuales conforme al art. 30, derechos de auditoría y de acceso, apoyo en incidentes, participación en pruebas y regulaciones de salida. Una fase propia del módulo guía a los proveedores por estos requisitos.

Base jurídica

• Art. 2 DORAArticle 2 DORA Scope1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities: - (a) credit institutions; - (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366; - (c) account information service providers; - (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC; - (e) investment firms; - …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Ámbito de aplicación
• Art. 3 DORAArticle 3 DORA DefinitionsFor the purposes of this Regulation, the following definitions shall apply: (1) ‘digital operational resilience’ means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Definiciones, entre otras: servicios de TIC y función crítica o importante
• Art. 5 DORAArticle 5 DORA Governance and organisation1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience. 2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Gobernanza y responsabilidad del órgano de dirección
• Art. 16 DORAArticle 16 DORA Simplified ICT risk management framework1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Marco simplificado de gestión del riesgo de TIC
• Art. 19 DORAArticle 19 DORA Reporting of major ICT-related incidents and voluntary notification of significant cyber threats1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Notificación de incidentes graves relacionados con las TIC
• Art. 28 DORAArticle 28 DORA General principles1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: - (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Riesgo de terceros proveedores de TIC y registro de información
• Art. 30 DORAArticle 30 DORA Key contractual provisions1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format. 2. The contractual arrangements on the use …Versión: 05.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Disposiciones contractuales esenciales
• Art. 5 DelVO (EU) 2025/301Article 5 Delegated Regulation (EU) 2025/301 Time limits for the initial notification, and for the intermediate and final reports1. Financial entities shall submit the initial notification and the intermediate and final reports as referred to in Article 19(4), points (a), (b) and (c), of Regulation (EU) 2022/2554 within the following time limits: - (a) for the initial report: as early as possible, but in any case, within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours …Versión: 06.10.2026 · Fuente: EUR-LexAbrir el original (EUR-Lex) ↗Plazos de la notificación inicial, intermedia y final