What is DORA?
DORA is the EU regulation on digital operational resilience for the financial sector, which has applied since 17 January 2025.
Regulation (EU) 2022/2554 covers banks, insurers, investment firms and payment institutions, among others. It brings together requirements on managing ICT risk, reporting incidents, testing resilience and overseeing ICT services from third parties.
The financial entity remains fully responsible even when a service is bought in. Every contract for ICT services must be entered in a register of information, and services supporting critical or important functions require an exit strategy, among other things.
As a regulation, DORA applies directly in every member state. In Sweden, Finansinspektionen's rules require the register of information to be reported by 28 February each year.
How it works
DORA rests on a few main areas. The entity must have a framework for ICT risk, report major incidents, test its resilience and oversee its ICT suppliers. Certain larger entities must also carry out advanced testing that mimics real attacks.
The European supervisory authorities have also designated critical ICT third-party providers that are directly overseen at EU level. These are large providers that many financial entities depend on.
Why it matters
Many financial entities use the same providers of cloud services and software. If one of them stops working, many can be affected at once. DORA is meant to ensure that every entity knows its dependencies and can handle an outage.
What to keep in mind
Think about the whole chain. An AI service can rely on a model from one party and run at another, and subcontractors supporting critical or important functions must appear in the register.
For financial entities also covered by the EU cybersecurity directive, DORA is what primarily applies to ICT risk. When the AI service processes personal data, the question of a data processor comes in as well.
What it means for you
An AI tool from an outside supplier is an ICT service like any other. It belongs in the register and in the assessment of concentration risk.
Common questions
Does DORA apply to AI services?
Yes, when they are ICT services that a financial entity buys in. The same requirements on contracts, the register and follow-up then apply as for other ICT services.
What is the register of information?
A record of all contracts for ICT services from third parties. In Sweden it is reported to Finansinspektionen by 28 February each year.
How does DORA relate to NIS2?
For the financial entities it covers, DORA is what primarily applies to ICT risk. Read more about NIS2.
Sources: Regulation (EU) 2022/2554 on EUR-LexFinansinspektionen on ICT risk and DORA (in Swedish)FFFS 2024:20 at Finansinspektionen (in Swedish)
Related terms
Read more
All terms Updated