EU regulation · Regulation (EU) 2022/2554 on digital operational resilience for the financial sector
DORA
DORA sets requirements for how financial entities manage ICT risk, report ICT-related incidents, test their resilience and manage risk from ICT third-party providers. Product makers usually meet it as suppliers to banks, insurers and other financial entities.
Checked 18 Oct 2026
What it asks
- An ICT risk-management framework.
- Classification and reporting of major ICT-related incidents.
- Digital operational resilience testing.
- Contractual requirements for ICT third-party providers.
How Complia supports the work
- 01
References down to the article
Requirements arrive with their DORA article reference and a link to the official text, so every task shows where it comes from.
- 02
Owner, evidence and review
Each requirement gets an owner, linked evidence and an independent review – the same workflow as every other source.
- 03
Cross-mapping
See where it overlaps with the CRA, ISO/IEC 27001 or your own standards, so evidence collected once supports several requirements.
What stays with you
DORA obligations rest with the financial entity; as a supplier you show how your product supports them. The structure in Complia is unchecked until you verify it against the official text.
Other frameworks
See it with your own product.
We go through your requirements, owners and next steps in a walkthrough.