A Regulation, Not a Directive: What That Changes
The single most important legal fact about DORA is its instrument type. It is a Regulation — Regulation (EU) 2022/2554 — not a Directive. For a legal team, that one distinction changes how the whole framework binds your client.
Regulation versus Directive
A Directive sets an objective and leaves each Member State to transpose it into national law, producing 27 slightly different national regimes and a transposition delay. A Regulation is directly applicable: it takes effect as law in every Member State on its own terms, without national transposition, and largely without the interpretive variation lawyers are used to navigating. DORA entered into force on 16 January 2023 and became fully applicable on 17 January 2025.
The layered legal architecture
| Layer | Instrument | Legal effect |
|---|---|---|
| Level 1 | Regulation (EU) 2022/2554 (DORA itself) | Directly applicable; the primary obligations. |
| Level 2 | Delegated Regulations (RTS) & Implementing Regulations (ITS) | Also directly applicable; fill in the technical detail (e.g. clause specifics, the Register format, incident classification). |
| Level 3 | ESA guidelines & Q&As | Not binding law, but supervisory expectation — ignore at your client’s risk. |
An RTS is a delegated Regulation, so it binds with the same force as DORA itself. When you cite «RTS 2024/1772» or the «ITS on the Register (Reg (EU) 2024/2956)», you are citing directly applicable EU law, not soft guidance.
That was your free preview
Enrol to unlock all 30 lessons, every knowledge check, the dedicated certification exam, the downloadable toolkit and your verifiable certificate — lifetime access.
Secure payment via Stripe · 30-day money-back guarantee.