DORA – Regulamento (UE) 2022/2554 relativo à resiliência operacional digital

Aplica-se ao meu caso?

O DORA aplica-se diretamente às entidades financeiras nos termos do art. 2.º, por exemplo instituições de crédito, instituições de pagamento e de moeda eletrónica, empresas de investimento, sociedades gestoras de ativos, seguradoras e resseguradoras e prestadores de serviços de criptoativos. Na Alemanha, o § 1a, n.º 2, KWG, o § 1a, n.º 2a, KWG (obrigações de notificação desde 17 de janeiro de 2025, quanto ao restante a partir de 1 de janeiro de 2027) e o § 293, n.º 5, VAG alargam o círculo. Para microempresas e empresas abrangidas pelo quadro simplificado nos termos do art. 16.º aplicam-se alívios. Para as instituições financeiras, o DORA prevalece sobre a regulamentação NIS2 como ato mais específico, na medida em que o DORA contenha requisitos equivalentes (art. 4.º da Diretiva NIS2).

Prestadores de serviços de TI, cloud, software e serviços geridos são afetados indiretamente como prestadores terceiros de serviços de TIC: os seus clientes financeiros continuam plenamente responsáveis e têm de exigir deles o conteúdo contratual nos termos do art. 30.º, direitos de auditoria e de acesso, apoio em incidentes, colaboração em testes e regras de saída. Uma fase própria do módulo guia os prestadores por estes requisitos.

Base jurídica

• Art. 2 DORAArticle 2 DORA Scope1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities: - (a) credit institutions; - (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366; - (c) account information service providers; - (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC; - (e) investment firms; - …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Âmbito de aplicação
• Art. 3 DORAArticle 3 DORA DefinitionsFor the purposes of this Regulation, the following definitions shall apply: (1) ‘digital operational resilience’ means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Definições, entre outras de serviços de TIC e função crítica ou importante
• Art. 5 DORAArticle 5 DORA Governance and organisation1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience. 2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Governação e responsabilidade do órgão de administração
• Art. 16 DORAArticle 16 DORA Simplified ICT risk management framework1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Quadro simplificado de gestão de riscos de TIC
• Art. 19 DORAArticle 19 DORA Reporting of major ICT-related incidents and voluntary notification of significant cyber threats1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Notificação de incidentes graves relacionados com as TIC
• Art. 28 DORAArticle 28 DORA General principles1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: - (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Risco de terceiros prestadores de TIC e registo de informações
• Art. 30 DORAArticle 30 DORA Key contractual provisions1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format. 2. The contractual arrangements on the use …Versão de: 05.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Disposições contratuais essenciais
• Art. 5 DelVO (EU) 2025/301Article 5 Delegated Regulation (EU) 2025/301 Time limits for the initial notification, and for the intermediate and final reports1. Financial entities shall submit the initial notification and the intermediate and final reports as referred to in Article 19(4), points (a), (b) and (c), of Regulation (EU) 2022/2554 within the following time limits: - (a) for the initial report: as early as possible, but in any case, within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours …Versão de: 06.10.2026 · Fonte: EUR-LexAbrir o original (EUR-Lex) ↗Prazos para a notificação inicial, intermédia e final