DORA Application Date and Next Deadlines

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, entered into force on 16 January 2023 and has applied to EU financial entities since 17 January 2025 (Article 64). The regulation sets no general transition period after that date. What remains are recurring obligations: the register of information cycle, the clocks on major incident reports, resilience tests at least every year and threat-led penetration testing at least every three years. There are also supervisory milestones that bind the European Supervisory Authorities (ESAs) and the Commission, not financial entities.

DORA is an EU regulation, so it is directly applicable in every Member State without national transposition. It sets requirements on ICT risk management, ICT-related incident reporting, digital operational resilience testing and ICT third-party risk, and it creates an EU oversight framework for critical ICT third-party service providers. This page lists the dates that framework runs on. For the content of each obligation, in order, see DORA compliance.

When did DORA enter into force and start applying?

The regulation was published in the Official Journal of the European Union (OJ L 333) on 27 December 2022. Article 64 sets the two dates that matter: it entered into force on the twentieth day following publication, which was 16 January 2023, and it applies from 17 January 2025.

A companion directive, Directive (EU) 2022/2556, published in the same Official Journal, amends the sectoral directives (banking, insurance, funds and payment services among them) so that they refer to DORA. Under its Article 9, Member States had to adopt and publish the transposing measures by 17 January 2025 and apply them from that date.

The two years between entry into force and application were the preparation period. Since 17 January 2025 the obligations have applied in full. A competent authority can take the maturity of your arrangements into account in how it supervises, but that is supervisory practice, not a legal deferral. Our earlier note on the January 2025 deadline covers what had to be in place on that day.

Who has been in scope since 17 January 2025?

Article 2(1) lists 21 points, (a) to (u). Points (a) to (t) are categories of financial entity, among them credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, insurance and reinsurance undertakings, institutions for occupational retirement provision, managers of alternative investment funds and management companies. Point (u) covers ICT third-party service providers. They come within the regulation mainly through the oversight framework and through the contractual requirements their financial-sector clients must impose (Article 30).

Article 16 gives certain entities a simplified ICT risk management framework instead of Articles 5 to 15, including small and non-interconnected investment firms and certain exempted payment and electronic money institutions. The simplified regime changes what those entities must do. It does not change the date from which they had to do it.

For groups, Article 28(3) requires the register of information to be maintained at entity level and at sub-consolidated and consolidated levels. Each legal entity's calendar therefore feeds the group calendar, which is why the planning section below works at both levels.

Key DORA dates and recurring deadlines

The table separates fixed dates from recurring obligations. Rows marked Commission or ESAs are duties of those bodies, not deadlines for financial entities.

To turn these dates into a plan for your own entity, use the DORA compliance timeline calculator.

Which Level 2 texts complete the timeline?

Several deadlines and formats are set not in DORA itself but in the regulatory technical standards (RTS) and implementing technical standards (ITS) adopted by the Commission. The ones that drive the calendar are:

1. Delegated Regulation (EU) 2024/1774: ICT risk management tools, methods, processes and policies, and the simplified framework.
2. Delegated Regulation (EU) 2024/1772: criteria for classifying ICT-related incidents and cyber threats.
3. Implementing Regulation (EU) 2024/2956: standard templates for the register of information.
4. Delegated Regulation (EU) 2025/301: content and time limits for major incident reports.
5. Implementing Regulation (EU) 2025/302: standard forms and templates for those reports.
6. Delegated Regulation (EU) 2025/1190: threat-led penetration testing.

Our RTS and ITS overview covers each standard in detail, and the full article list is on the DORA regulation text page.

What are the register of information deadlines?

Article 28(3) requires each financial entity to maintain and update a register of information (RoI) on all its contractual arrangements for ICT services provided by ICT third-party service providers, to report on it to the competent authority at least yearly, and to make the full register available on request. Implementing Regulation (EU) 2024/2956 fixes the templates.

The cycle runs in two steps. The financial entity submits its register to its competent authority, in the window and through the channel that authority sets. The competent authorities then transmit the registers to the ESAs, which use them, among other things, to prepare the designation of critical providers. For the first collection, in 2025, competent authorities transmitted the registers to the ESAs by 30 April 2025.

The entity-level date is national. Check your own authority's communication (for example ACPR, AMF, BaFin or CSSF) rather than relying on a single EU date. Our register of information page lists the national dates we track, with templates and validation, and the 2026 register guide walks through a submission.

What are the incident reporting time limits?

Article 19 requires financial entities to report major ICT-related incidents to their competent authority. Article 5 of Delegated Regulation (EU) 2025/301 sets the clocks:

1. Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
2. Intermediate report: within 72 hours of the initial notification, with an updated report once regular activities have been recovered.
3. Final report: no later than one month after the latest intermediate report.

The same article provides relief for deadlines that fall on a weekend or public holiday, which does not extend to every category of entity: check Article 5 of Delegated Regulation (EU) 2025/301 for whether yours is excluded. Classification criteria, templates and the sequence of filings are covered in our article on DORA incident reporting timelines.

When must threat-led penetration testing be performed?

Article 26(1) requires the financial entities identified by their competent authority to carry out advanced testing by means of threat-led penetration testing (TLPT) at least every three years. Based on the entity's risk profile, the competent authority can ask it to reduce or increase that frequency. Delegated Regulation (EU) 2025/1190 sets out the identification criteria, scope, methodology, the use of internal testers and cooperation between authorities, in line with the TIBER-EU framework.

For a group, the practical issue is coordinating tests across entities and with the ICT third-party service providers whose services are in scope. Article 30(3)(d) requires contracts covering critical or important functions to oblige those providers to take part in the financial entity's TLPT. Our TLPT guide covers scope and preparation.

What is the timeline for critical ICT third-party providers?

On 18 November 2025 the ESAs published the first list of designated critical ICT third-party providers (CTPPs) under Article 31. The official list names 19 providers, and our list of designated CTPPs sets them out. Article 31(9) requires the ESAs to update the list every year.

Two consequences for client entities follow. Designation does not reduce your own obligations: your contracts must still meet Article 30, including audit rights and exit strategies, and your register must still describe these arrangements. And under Article 31(12), a designated provider established in a third country must set up a subsidiary in the Union within 12 months of designation for financial entities to keep using its services. Our third-party risk guide covers both.

What review dates does the regulation set?

Article 58 sets three review points. All three are duties of the Commission, not deadlines for financial entities:

• By 17 July 2023, in the context of the review of the Payment Services Directive: an assessment of whether payment systems and payment-processing activities should come within scope (Art. 58(2)).
• By 17 January 2026: a review of whether to strengthen digital operational resilience requirements for statutory auditors and audit firms (Art. 58(3)).
• By 17 January 2028: a general review, including the criteria for designating CTPPs, with a legislative proposal where appropriate (Art. 58(1)).

The 2028 date is often presented as a compliance deadline. It is not one: it is a reporting duty of the Commission. This page does not anticipate what that review will contain.

How should a large group plan its DORA compliance calendar?

A workable annual cycle, to adapt to the dates your competent authorities set:

1. Before each register window: freeze the contract data and update the register at entity, sub-consolidated and consolidated levels.
2. Within each national window: validate and submit the registers, entity by entity.
3. Throughout the year: keep the incident classification and reporting process ready to run on the 4-hour, 72-hour and one-month clocks.
4. At least yearly: review the ICT risk management framework (Art. 6(5)), test the ICT business continuity and response and recovery plans (Art. 11(6)), and test the ICT systems supporting critical or important functions (Art. 24(6)).
5. On a three-year cycle: plan TLPT for the entities your competent authority has identified, with the providers in scope.
6. After each annual CTPP list update: review the affected contracts and exit plans against Article 30.

Keeping these recurring tasks on schedule across several entities is a tooling question as much as a legal one. Resiplan, for example, offers a DORA compliance programme that derives tasks from the obligations and tracks them per entity.