Useful links
Official EU resources relevant to the interpretation, application and enforcement of the DORA
Official European Union sources specific to the DORA that a practitioner is likely to need day to day, grouped by type and ordered by likely usefulness. All links were checked on 30 October 2026.
1. The legislation
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Official Journal text eur-lex.europa.eu
- Directive (EU) 2022/2556 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector, Official Journal text eur-lex.europa.eu
- Procedure file 2020/0266(COD) (European Parliament Legislative Observatory) oeil.europarl.europa.eu
2. Delegated and implementing acts
- Implementing and delegated acts - DORA: the Commission's page listing them (European Commission, DG FISMA) finance.ec.europa.eu
- Commission Delegated Regulation (EU) 2024/1774: ICT risk management tools, methods, processes and policies and the simplified ICT risk management framework (Article 15 and Article 16(3)); corrected by the corrigendum in OJ L, 2025/90420, 15.5.2025 eur-lex.europa.eu
- Corrigendum to Commission Delegated Regulation (EU) 2024/1774, OJ L, 2025/90420, 15.5.2025 eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2024/1772: classification of ICT-related incidents and cyber threats, materiality thresholds and details of reports of major incidents (Article 18(4)) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2025/301: content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification of significant cyber threats (Article 20) eur-lex.europa.eu
- Commission Implementing Regulation (EU) 2025/302: standard forms, templates and procedures for reporting major ICT-related incidents and notifying significant cyber threats (Article 20) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2025/1190: threat-led penetration testing (Article 26(11)) eur-lex.europa.eu
- Commission Implementing Regulation (EU) 2024/2956: standard templates for the register of information (Article 28(9)); corrected by the corrigendum in OJ L, 2025/90725, 19.9.2025 eur-lex.europa.eu
- Corrigendum to Commission Implementing Regulation (EU) 2024/2956, OJ L, 2025/90725, 19.9.2025 eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2024/1773: policy on contractual arrangements for ICT services supporting critical or important functions (Article 28(10)) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2025/532: subcontracting of ICT services supporting critical or important functions (Article 30(5)) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2024/1502: criteria for designating ICT third-party service providers as critical (Article 31(6)) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2025/295: harmonisation of conditions for the conduct of oversight activities (Article 41(2)) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2025/420: composition, designation, tasks and working arrangements of the joint examination team (Article 41(2)) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2024/1505: amount and payment of oversight fees charged to critical ICT third-party service providers (Article 43(2)) eur-lex.europa.eu
3. EU-level guidance and information
- Cyber resilience: the Commission's page on DORA, with its timeline (European Commission, DG FISMA) finance.ec.europa.eu
- Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents (Article 11(11)): final report JC 2024 34, 17 July 2024 (Joint Committee of the European Supervisory Authorities) esma.europa.eu
- Joint Committee Report on the feasibility for further centralisation of reporting of major ICT-related incidents under DORA (Article 21), 17 January 2025 (European Supervisory Authorities) eiopa.europa.eu
- List of designated critical ICT third-party service providers (Article 31(9)) (European Supervisory Authorities; first published 18 November 2025) esma.europa.eu
- The European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience Act, 18 November 2025 (ESMA) esma.europa.eu
- Joint Guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities (Article 32(7)), JC/GL/2024/36, 6 November 2024 (European Supervisory Authorities) esma.europa.eu
- DORA Oversight Guide: how the ESAs oversee critical ICT third-party service providers, 15 July 2025 (European Supervisory Authorities) eiopa.europa.eu
4. Regulators, authorities and bodies
- Digital Operational Resilience Act (European Banking Authority) eba.europa.eu
- DORA oversight of critical ICT third-party providers (European Banking Authority) eba.europa.eu
- Digital Operational Resilience Act (DORA) (European Insurance and Occupational Pensions Authority) eiopa.europa.eu
- Digital Operational Resilience Act (DORA) (European Securities and Markets Authority) esma.europa.eu