This article in brief
- Regulation (EU) 2022/2554, known as DORA, has applied since 17 January 2025 to financial entities and to their IT service providers.
- Every contract with an ICT provider must contain the minimum clauses of Article 30(2); stronger clauses are added when the service supports a critical or important function (Article 30(3)).
- Each entity keeps a register of information listing all its ICT contracts (Article 28(3)); it submits it every year to the ACPR (French Prudential Supervision and Resolution Authority), by 31 March at the latest (ACPR Instruction No. 2025-I-12).
- Major ICT-related incidents are reported to the competent authority, the ACPR for the entities it supervises, according to the criteria of Delegated Regulation (EU) 2024/1772 (Article 19).
- In France, threat-led penetration testing (TLPT) is steered by the Banque de France, the ACPR and the AMF (French financial markets authority) under the TIBER-FR framework.
- Compliance is as much contractual as technical: renegotiating existing contracts, exit strategy, mapping of dependencies.
The DORA regulation (Digital Operational Resilience Act, Regulation (EU) 2022/2554 of 14 December 2022) has imposed, since 17 January 2025, a common digital operational resilience framework on the European financial sector. Banks, insurers, asset management companies, crypto-asset service providers and fintechs must manage their IT risk, report their incidents, test their resilience and oversee their IT providers. For legal departments, most of the work lies in the contracts: mandatory clauses, register of information, exit strategy. Here is what the text actually requires, and how to comply with it.
The official text of the DORA regulation: Regulation (EU) 2022/2554 of 14 December 2022, published in the Official Journal of the European Union of 27 December 2022 (L 333). It entered into force on 16 January 2023 and has applied since 17 January 2025 (Article 64).
Download the DORA regulation as a PDF (EUR-Lex) · read it online. For an audit of your ICT contracts or your register, call the firm on 01 85 73 56 66 or write to us.
Who does DORA apply to?
DORA applies to financial entities in the broad sense: credit institutions, investment firms, asset management companies, insurance and reinsurance undertakings, intermediaries, payment and electronic money institutions, crypto-asset service providers, among other categories listed in Article 2 of the regulation. It also reaches, indirectly, their ICT third-party service providers: software vendors, hosting providers, cloud providers. Providers considered critical at European level fall under a dedicated oversight framework.
Unlike the NIS 2 Directive, which covers a wide range of sectors and is still awaiting its French transposition law, DORA is a regulation: it applies directly, without any national legislation. An IT provider outside the financial sector can therefore be caught by DORA through its bank or insurer clients, which pass their own obligations on to it by contract. On how the two texts fit together, see our page on the NIS 2 Directive.
The four sets of obligations
The ACPR summarises the regulation in four pillars: ICT risk management (governance, mapping, security policies, under the responsibility of the management body); incident reporting; digital operational resilience testing; and the management of third-party risk arising from IT providers. The last three call for practical detail, because they create time-bound obligations that can be verified.
DORA incident reporting: major incidents (Article 19)
Since 17 January 2025, financial entities report to their competent authority, the ACPR for entities within its remit, all major ICT-related incidents referred to in Article 19(1) of the regulation. The criteria for classifying an incident as major are set by Delegated Regulation (EU) 2024/1772; the reporting deadlines by Delegated Regulation (EU) 2025/301; and the notification templates by Implementing Regulation (EU) 2025/302. Reporting may be outsourced to a provider (Article 19(5)), with the entity remaining fully responsible; the entity informs the competent authority as soon as the agreement is concluded and at the latest before the first notification (Article 6 of Implementing Regulation 2025/302).
The deadlines are short:
| Step | Deadline | Text |
|---|---|---|
| Initial notification | 4 hours after the incident is classified as major, and no later than 24 hours after becoming aware of it | Delegated Regulation 2025/301, Art. 5(1) |
| Intermediate report | No later than 72 hours after the initial notification | Delegated Regulation 2025/301, Art. 5(1) |
| Final report | No later than 1 month after the intermediate report or its latest update | Delegated Regulation 2025/301, Art. 5(1) |
| Informing clients | Without undue delay, if the incident has an impact on their financial interests | DORA, Art. 19(3) |
When a deadline falls on a weekend or a public holiday, most entities may submit by noon on the next working day (Article 5(4) of the Delegated Regulation). For the initial notification and the intermediate report, this leeway does not apply to certain entities, including credit institutions and central counterparties (Article 5(5)). An internal classification and escalation procedure, tested in advance, is therefore essential.
This report is made in addition to, and does not replace, the notification of a personal data breach to the CNIL (French data protection authority) when client or employee data is affected. The two regimes coexist, with different criteria and different recipients: our page personal data breach lawyer covers this second aspect.
Testing resilience: from routine testing to TLPT
DORA requires a testing programme proportionate to the size and risk profile of the entity. For designated entities, it culminates in threat-led penetration testing (TLPT): simulated attacks under real conditions, on live production systems. In France, these tests are steered by a joint Banque de France, ACPR and AMF team (the TCT-FR), on the basis of the TIBER-FR framework. The legal side is not incidental: contractual framework for the testers, scope of authorisation, confidentiality of the results, treatment of the data affected during the test.
DORA ICT third-party contracts: the core of the work
The minimum clauses of Article 30(2)
Every contractual arrangement for the use of ICT services must contain a minimum list of items: a complete description of the services, the locations of the data and of the processing, provisions on availability, integrity and confidentiality, assistance in the event of an incident, termination rights and notice periods, and the provider’s participation in awareness programmes. A cloud or managed services contract signed on the provider’s standard terms alone rarely meets this baseline.
Stronger clauses for critical or important functions (Article 30(3))
When the service supports a critical or important function of the entity, further requirements apply: precise and measurable service levels, an obligation to cooperate with the authorities, rights of access, inspection and audit for the entity and its supervisors, tested business continuity plans, and an exit strategy organising reversibility without service disruption. The upstream classification of the function therefore determines the contractual level required: it is a legal analysis as much as an operational one.
The register of information (Article 28(3))
Each entity keeps and updates a register of information listing all its contractual arrangements with ICT providers, at every level of the group: individual, sub-consolidated and consolidated. This register is submitted to the authorities; the ACPR requires it to be submitted annually, by 31 March at the latest, with data as at the previous 31 December (Instruction No. 2025-I-12), and publishes a detailed FAQ on its content. Planned arrangements covering critical or important functions must also be reported to the competent authority in good time. Keeping this register requires an inventory of all contracts, including the oldest ones: the exercise often reveals arrangements that were never renegotiated, with no audit clause and no exit strategy.
For software vendors and providers themselves, the effect is symmetrical: their financial clients now demand DORA amendments. Our pages SaaS lawyer and IT contracts lawyer describe how we assist on both sides of the table.
What are the risks of non-compliance?
Enforcement of DORA lies with the sectoral supervisory authorities, in France the ACPR and the AMF, which have their usual powers of injunction and sanction. The “directive” part of the DORA package, which adjusts the sectoral texts, is included in the French bill on the resilience of critical infrastructure, which had not been enacted at the date this article was updated. Beyond prudential risk, a non-compliant ICT contract above all exposes the entity to a very concrete operational risk: inability to audit a failing provider, no exit strategy at the moment the provider needs to be replaced, a weakened position in discussions with the insurer after an incident.
DORA compliance in France: how we assist
We work on the legal side, in coordination with your IT teams and your technical providers:
- Mapping and register: inventory of ICT contracts, creation and updating of the register of information;
- Classification of critical or important functions, which sets the contractual level required;
- DORA amendments: drafting and negotiation in light of Articles 28 and 30, for financial entities and for providers alike;
- Incident procedure: classification and reporting workflow within the deadlines of Delegated Regulation 2025/301, coordinated with notification to the CNIL;
- Resilience testing: legal framework for tests and TLPT;
- Interplay with the GDPR and the NIS 2 Directive.
In Paris, Hashtag Avocats assists fintechs, payment institutions and software vendors serving the financial sector: see our page fintech lawyer and, for the overall security dimension, our page cybersecurity lawyer. For an initial discussion, call the firm on 01 85 73 56 66 or write to us. Every situation is different.
Frequently asked questions about the DORA regulation
Does DORA already apply?
Yes. Regulation (EU) 2022/2554 has applied since 17 January 2025, directly and without a transposition law. Only the “directive” part of the package, which adjusts sectoral texts, is still awaiting its French law.
Who must keep the register of information?
All financial entities within the scope of DORA, for all their contractual arrangements with ICT providers, at individual, sub-consolidated and consolidated level (Article 28(3)). Submission to the ACPR is annual, by 31 March at the latest, and the obligation to keep it updated is ongoing.
Is a non-authorised fintech affected?
The scope set out in Article 2 covers regulated entities in the financial sector. An unregulated technology company is not directly subject to DORA, but its financial clients must impose on it, by contract, the clauses of Article 30(2) as soon as it provides them with ICT services, and those of Article 30(3) where these services support a critical or important function.
What is the difference between DORA and NIS 2?
DORA is a regulation, directly applicable, reserved for the financial sector. NIS 2 is a multi-sector directive whose French transposition law has not been enacted. A financial entity falls under DORA for its resilience obligations; a single group may have subsidiaries subject to one regime or the other.
What does an entity risk if its ICT contracts are not compliant?
Supervisory measures from the ACPR or the AMF, but also direct operational risks: no audit right over a failing provider, reversibility impossible for lack of an exit strategy, a weakened position in discussions with the insurer after an incident.
When did the DORA regulation enter into force?
Regulation (EU) 2022/2554 entered into force on 16 January 2023, twenty days after its publication in the Official Journal of the European Union of 27 December 2022. Its obligations have applied since 17 January 2025 (Article 64).
What are the deadlines for reporting a major incident?
Initial notification within 4 hours of the incident being classified as major and no later than 24 hours after its discovery, intermediate report within 72 hours, final report within one month (Article 5 of Delegated Regulation (EU) 2025/301).
Where can I find the official text of the DORA regulation?
On EUR-Lex, the official website for EU law, as a PDF or in HTML. The implementing texts, including Regulations 2024/1772, 2025/301 and 2025/302, are also published there.
Official sources
- Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (DORA) – EUR-Lex
- ACPR, “Digital Operational Resilience Act (DORA)”, overview and implementing texts – acpr.banque-france.fr
- ACPR, “FAQ sur la directive et le règlement DORA” (FAQ on the DORA directive and regulation) (register of information, Articles 28(3) and 30(2)-(3), incidents under Article 19, TLPT TIBER-FR) – acpr.banque-france.fr
- Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024, criteria for the classification of ICT-related incidents – EUR-Lex
- Articles 33 and 34 of Regulation (EU) 2016/679 (GDPR), notification of personal data breaches – EUR-Lex
- Commission Delegated Regulation (EU) 2025/301 of 23 October 2024, time limits for reporting major incidents (Article 5) – EUR-Lex
- Commission Implementing Regulation (EU) 2025/302 of 23 October 2024, notification forms and templates – EUR-Lex
This article sets out the state of the law for general information purposes, checked at the date of publication. It does not constitute legal advice. Every situation is different and deserves a dedicated analysis. Content compliant with the professional conduct rules of the legal profession.
