DORA (Digital Operational Resilience Act): RoI&ICT reporting

What is DORA?

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, is the EU framework for digital operational resilience in the financial sector. It is accompanied by Directive (EU) 2022/2556, which aligns related sectoral directives.

DORA reflects the sector’s dependence on information and communication technology (ICT) and on ICT third-party service providers. Weak ICT risk management can disrupt services at firm level and across the wider financial system.

Since 17 January 2025, DORA has applied across the EU. Financial entities must operate under its ICT risk, incident-reporting, testing, and third-party risk rules on an ongoing basis. The European Supervisory Authorities (EBA, EIOPA, and ESMA) oversee Critical ICT Third-Party Service Providers (CTPPs) at the European Union level. For a concise overview of the pillars, see also In conversation with Google Cloud - DORA overview.

Who is in scope?

DORA applies to a broad set of financial entities in the EU, including:

Credit institutions
Investment firms
Payment institutions
Account information service providers
Electronic money institutions
Insurance and reinsurance undertakings
Crypto-asset service providers
Trading venues
Institutions for occupational retirement provision (IORPs)
ICT third-party service providers (including designated CTPPs)

Proportionality and limited exemptions apply for some entity types. Always confirm scope with your competent authority.

Significant institutions (SIs) under ECB Banking Supervision submit their Register of Information to the ECB. Other financial entities submit to their national competent authority (NCA), which forwards registers to the ESAs for CTPP designation and oversight. For practical RoI submission notes, see Regnology’s DORA Compliance Checklist.

Ongoing obligations

DORA is live. Supervisory focus has shifted to data quality, annual RoI cycles, incident-reporting maturity, and CTPP oversight.

Annual calendar

Obligation	Pattern
Major ICT-related incidents & significant cyber threats	Report to the competent authority under Chapter III (ongoing)
Register of Information (RoI) reference date	31 December of the year before the reporting year
RoI submission to NCA or ECB	National / SSM window , typically January–March of the reporting year
NCAs forward RoIs to the ESAs	By end of March of the reporting year
ESA data-quality follow-up	May trigger resubmission after initial acceptance

Templates and technical rules for the RoI are set out in Commission Implementing Regulation (EU) 2024/2956 (ITS on standard RoI templates). Operational packages, validations, and FAQs are maintained on the EBA preparations for reporting of DORA registers of information page.

Recent developments

18 November 2025: ESAs designate 19 CTPPs; EBA is Lead Overseer for designated providers.
2026 RoI cycle: Data-quality checks and possible resubmissions; use the latest EBA RoI materials.
3 June 2026: First joint ESA annual report on major ICT-related incidents.

What does DORA require?

DORA sets a common digital operational resilience framework for financial entities and for oversight of critical ICT providers (Regulation (EU) 2022/2554):

ICT risk management (Chapter II, Arts. 5–16): governance, risk assessment, and controls.
ICT-related incident management, classification, and reporting (Chapter III, Arts. 17–23): detection, classification, and notification of major ICT-related incidents and, where required, significant cyber threats.
Digital operational resilience testing (Chapter IV, Arts. 24–27): including advanced testing such as threat-led penetration testing (TLPT) for identified entities.
ICT third-party risk management (Chapter V, Section I, Arts. 28–30): contractual arrangements, monitoring, and the Register of Information (RoI) on ICT third-party service providers (Art. 28(3)).
Oversight of CTPPs (Chapter V, Section II, Arts. 31–44): Union-level oversight of designated critical providers.
Information-sharing arrangements (Chapter VI, Art. 45): voluntary sharing of cyber threat information among financial entities.

Register of Information (RoI)

The RoI is the structured register of contractual arrangements on the use of ICT services provided by ICT third-party service providers, maintained at entity, sub-consolidated, and consolidated levels as required under Art. 28(3) and the ITS on RoI templates (EU) 2024/2956. It supports firm-level ICT third-party risk management, competent-authority supervision, and ESA designation of CTPPs.

It is not a register of ICT incidents or of general resilience measures. Incident reporting is a separate Chapter III obligation.

DORA

Reporting formats and technical package

DORA reporting relies on standardised templates and technical packages issued by the ESAs / EBA:

Major ICT-related incidents and significant cyber threats: structured reports to the competent authority under Chapter III.
Register of Information (RoI): submitted in the required format under the RoI ITS and the EBA reporting framework.

Always use the latest materials on the EBA preparations for reporting of DORA registers of information page.

DORA and NIS2

DORA complements broader EU cybersecurity law, including the NIS 2 Directive (EU) 2022/2555. For financial entities in scope of DORA, DORA operates as lex specialis: its sector-specific ICT risk and incident-reporting rules take precedence over the corresponding NIS2 requirements.

Where AI systems support credit scoring or regulatory reporting, also see Regnology’s EU Artificial Intelligence Act page.

How Regnology supports DORA reporting

Regnology helps financial entities meet DORA’s Register of Information (RoI) reporting obligations, collecting, validating, and submitting ICT third-party arrangement data in line with the ESA/EBA technical package.

DORA