Regulatory Intelligence · DORA Last verified · Sep 2026
Proposed in 2020 after years of fragmented ICT rules, the Digital Operational Resilience Act (Reg. (EU) 2022/2554) has applied since 17 January 2025. Unlike its sibling regulations, DORA's countdown is over — this tracker follows how each promise is holding up under live supervision.
DORA is live law, not a future deadline: ICT risk frameworks, incident reporting and third-party registers have been mandatory since 17 Jan 2025. Many regulators treated 2025 as a de facto transition year while supervisory tooling caught up — 2026 is when enforcement sharpens, with the first annual Register of Information cycle closing by 31 March 2026 (20 March for some regulators, e.g. the Dutch DNB) under stricter validation, 19 critical ICT providers (incl. major clouds, designated 18 Nov 2025) now under direct EU oversight, and first threat-led penetration testing cycles underway.
DORA applies in full: ICT risk management, incident classification & reporting, third-party contracts. 20+ entity types from banks to crypto firms.
ESAs designated the first 19 critical third-party providers (18 Nov 2025) — hyperscale clouds, data centres, network and fintech-specific providers now under direct EU oversight via Joint Examination Teams.
Register of Information annual resubmission closed by 31 March 2026 (20 March for some regulators, e.g. DNB) under stricter checks, first TLPT cycles for designated entities, and the Commission's Art. 58 review of scope (incl. auditors), due 17 Jan 2026.
⏱ DORA has been live law for — days · Supervisory patience is expiring with it
Filter by your industry
Filter by context