Every one of the 64 articles with its official heading, a direct link into the EUR-Lex text, the delegated or implementing act it empowers, and where this site explains it. The regulation itself is on EUR-Lex, in 24 languages: this page is the way in.
DORA is Regulation (EU) 2022/2554. It was signed on 14 December 2022, published in the Official Journal on 27 December 2022, and has applied since 17 January 2025. It runs to 64 articles across nine chapters, preceded by 106 recitals, and exists in the 24 official languages of the European Union. Only the EUR-Lex version is authoritative, so this page does not reproduce it: it indexes it, article by article, and shows which technical standard sits behind each mandate.
If you need to cite DORA in a policy, a board paper or a contract, these are the references that matter. The ELI link is the stable one: it does not break when EUR-Lex changes its interface.
A regulation, not a directive. Search queries often say "DORA directive". It is a regulation: it binds in its entirety and applies directly in all Member States, with no transposing national law in between. Article 64 says so in one sentence: "This Regulation shall be binding in its entirety and directly applicable in all Member States." The practical consequence is that there is no national version to look for, with one exception: the administrative penalty regime, which Article 50 leaves to Member State law.
Both links below go to EUR-Lex, the Official Journal's own publication service. The HTML version carries stable anchors, so #art_30 opens the contractual clauses directly instead of the top of the document. Every article number in the index further down uses those anchors. The PDF is the Official Journal typesetting, which is the version to attach to a board pack or an audit file.
Why this page does not host a copy. A regulation is amended, corrected and consolidated. A PDF sitting on a third-party site is a snapshot that silently goes stale, and anyone citing it in a supervisory file inherits that risk. EUR-Lex publishes the authentic text and its consolidated versions, so that is where the links point. What this site adds is the index, the mapping to the technical standards, and the practitioner reading.
Every language version is equally authentic. This matters more than it sounds: if your compliance documentation, your contracts or your board minutes are not in English, use the official terminology of your own language version rather than translating the English back. The vocabulary is fixed, and competent authorities use it.
Headings are the official ones. Each number links into the EUR-Lex text at that article. A purple tag means the article carries a mandate that the Commission has since filled with a delegated or implementing act; a blue tag points to where this site explains what the article asks for in practice.
DORA itself sets the obligations; the detail lives in the level-2 acts the Commission adopts on the mandates written into the articles. All of them are now adopted. The column that matters operationally is the middle one: it tells you which article you are actually complying with when you implement a technical standard. The same table, with the practitioner reading of each act, is on the RTS and ITS page.
| What it covers | DORA mandate | Legal act | Status |
|---|---|---|---|
| RTS on the ICT risk management framework and the simplified framework | Art. 15, Art. 16(3) | Commission Delegated Regulation (EU) 2024/1774 | Applies alongside DORA since 17 January 2025 |
| RTS on the classification of major ICT-related incidents and significant cyber threats | Art. 18(3) | Commission Delegated Regulation (EU) 2024/1772 | Applies alongside DORA since 17 January 2025 |
| RTS on the policy on ICT services supporting critical or important functions | Art. 28(10) | Commission Delegated Regulation (EU) 2024/1773 | Applies alongside DORA since 17 January 2025 |
| ITS on the Register of Information (template and taxonomy) | Art. 28(9) | Commission Implementing Regulation (EU) 2024/2956 | In force, annual submission through your competent authority |
| RTS on the criteria for the designation of critical ICT third-party service providers | Art. 31(6) | Commission Delegated Regulation (EU) 2024/1502 | In force, basis of the 2025 CTPP designations |
| Delegated Regulation on the oversight fees charged to designated CTPPs | Art. 43(2) | Commission Delegated Regulation (EU) 2024/1505 | In force, Official Journal 30 May 2024 |
| RTS on the harmonisation of conditions enabling the conduct of the oversight activities | Art. 41(1) | Commission Delegated Regulation (EU) 2025/295 | In force, Official Journal 13 February 2025 |
| RTS on the content and time limits for major ICT-related incident reporting | Art. 20(a) | Commission Delegated Regulation (EU) 2025/301 | In force, Official Journal 20 February 2025 |
| ITS on the standard forms and templates for major ICT-related incident reporting | Art. 20(b) | Commission Implementing Regulation (EU) 2025/302 | In force, Official Journal 20 February 2025 |
| RTS on joint examination teams | Art. 41(1)(c) | Commission Delegated Regulation (EU) 2025/420 | In force, adopted 16 December 2024 |
| RTS on the subcontracting of ICT services supporting critical or important functions | Art. 30(5) | Commission Delegated Regulation (EU) 2025/532 | In force since 22 July 2025, Official Journal 2 July 2025 |
| RTS on threat-led penetration testing | Art. 26(11) | Commission Delegated Regulation (EU) 2025/1190 | In force since 8 July 2025, Official Journal 18 June 2025 |
| Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents | Art. 11(11) | Joint Guidelines JC/GL/2024/34 | ESA guidelines, comply or explain at national level |
A detail worth holding on to: the last row is not a technical standard. Joint Guidelines are an ESA instrument that competent authorities apply on a comply-or-explain basis, which is a different legal weight from a Commission Delegated Regulation. Treating the two as interchangeable in a gap analysis is a common and avoidable error.
Three dates come from the regulation itself. Everything else circulating as a "DORA deadline" comes from a level-2 act, from a competent authority's own calendar, or from nowhere at all.
| Date | What the text says | Where |
|---|---|---|
| 16 January 2023 | Entry into force, the twentieth day after publication in the Official Journal | Art. 64 |
| 17 January 2025 | Date of application. From this date the obligations bind in full, with no transitional phasing written into the regulation | Art. 64 |
| 17 January 2028 | By this date the Commission must carry out a review and report to the Parliament and the Council, covering among other things the CTPP designation criteria and the voluntary nature of cyber threat notification | Art. 58 |
17 January 2028 is a review clause, not a compliance deadline. It is read online as a second DORA deadline, often attached to threat-led penetration testing. Article 58 says what it says: the Commission reviews and reports. Nothing in it moves an obligation for a financial entity. If a project plan carries a 2028 milestone, it should trace back to something other than this article.
Not every article creates work for a financial entity. Roughly half of the text is supervisory machinery: how the European Supervisory Authorities organise oversight of designated providers, how authorities cooperate, how fees are charged. Useful to know it exists, not something to implement. The reading below is ours, not the regulation's, and it is meant as a route through the text rather than a substitute for it.
You appear in Article 2(1), at point (u), but you are not a financial entity: Article 2(2) reserves that term for points (a) to (t). The obligations that reach you arrive through your clients' contracts under Article 30, and, only if the European Supervisory Authorities designate you as critical, through the oversight framework in Articles 31 to 44. The distinction is the single most misread thing about DORA on the supplier side, and it is set out in the guide for suppliers.
Articles 32 to 44 build and run the oversight framework for designated critical providers: the Lead Overseer, its powers, inspections, fees, international cooperation. Articles 46 to 56 organise competent authorities, their cooperation, professional secrecy and data protection. Article 57 is the delegation mechanism. Articles 59 to 63 amend five earlier regulations, including EMIR, CSDR and MiFIR. None of these creates a deliverable for an ordinary financial entity, and time spent reading them is better spent on Chapters II to V.
Article 2(1) lists the entities in scope, from point (a) to point (u). Points (a) to (t) are collectively "financial entities" under Article 2(2): credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, managers of alternative investment funds, management companies, data reporting service providers, insurance and reinsurance undertakings, insurance and reinsurance intermediaries, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers and securitisation repositories. Point (u) adds ICT third-party service providers.
The list is closed, and the legal category decides the regime. That is why the scope tool asks for your authorisation rather than your size or your sector, and why Article 16, the simplified framework, is available only to the categories the article itself names. Being small does not get you there if your legal category is not on that list.
The text tells you what is required. These pages tell you what to do about it, in the order most teams actually need it.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.