When banks and insurers staff for DORA, the compliance officer is the first hire. The role owns the second line: defining what compliance means, monitoring it, and answering to supervisors.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025. More than a year into live supervision, the question has moved from «what does DORA require?» to «are we meeting it, and can we prove it on demand?» That second question is the compliance officer’s job.

The core mandate

• Translate DORA & its RTS/ITS into a concrete obligations map for the entity.
• Monitor the first line’s controls and challenge gaps.
• Own regulatory reporting (incidents, Register of Information) and supervisory contact.
• Keep the management body informed and the evidence base audit-ready.

Why it is distinct from delivery

The project/programme manager builds DORA; the compliance officer assures it — independent, second-line, focused on whether obligations are actually met and provable. The two are complementary but must never collapse into one person: an officer who both operates and assures a control cannot give the management body an independent view. This certification builds the assurance craft, not the delivery craft.

Worked example. A mid-size bank hires its first DORA compliance officer six weeks before a supervisory information request. Rather than re-building controls, she assembles the obligations map, finds the three obligations with no evidence behind them, and closes those gaps first. When the request lands, the bank answers not because it did more, but because what it did was mapped, owned and evidenced.