What is DORA?
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets uniform ICT risk-management, incident-reporting, resilience-testing and third-party-risk requirements for around twenty types of EU financial entities, and creates an oversight framework for critical ICT third-party providers.
What is NIS2?
NIS2 (Directive (EU) 2022/2555) requires essential and important entities in sectors such as energy, transport, health, digital infrastructure and ICT service management to implement ten minimum cybersecurity measures and report significant incidents.
How do DORA and NIS2 compare?
| Aspect | DORA | NIS2 |
|---|---|---|
| Legal form | Regulation — applies directly | Directive — transposed into national law |
| Applies from | 17 January 2025 | 18 October 2024 (national laws) |
| Scope | Financial entities and critical ICT third-party providers | Essential and important entities in 18 sectors |
| Structure | Five pillars | Governance (Art. 20), measures (Art. 21), reporting (Art. 23) |
| Incident reporting | Initial 4h after classification (max 24h), intermediate 72h, final 1 month | Early warning 24h, notification 72h, final 1 month |
| Testing | Resilience testing programme; TLPT every 3 years for selected entities | Effectiveness assessment; no mandatory TLPT |
| Third parties | Detailed contract rules, register of information, CTPP oversight | Supply chain security measure |
| Supervisors | Financial supervisors (e.g. NBB, FSMA in Belgium) | Cybersecurity authorities (e.g. CCB in Belgium) |
Which one applies to my company?
- A bank, payment institution, e-money institution, investment firm or insurer: DORA applies; for ICT risk and incident reporting it replaces the equivalent NIS2 rules (Article 4 of NIS2 and DORA's lex specialis status).
- A cloud, data-centre or managed service provider serving banks: NIS2 may apply directly, and DORA applies through your customers' contracts; if designated critical, you are also overseen under DORA.
- A company in energy, health, transport or manufacturing: NIS2, not DORA.
How can one programme cover both?
Both laws expect a documented risk-management framework, incident handling, business continuity, supplier management and testing. ComplyPilot (EU compliance platform) links DORA pillars and NIS2 requirements to the same controls and evidence, often on top of an ISO 27001 ISMS, so a single backup-restore test or supplier review supports all three frameworks.
Which rule wins when both DORA and NIS2 could apply?
DORA wins for financial entities. DORA (Regulation (EU) 2022/2554) is a sector-specific act, and Article 4 of NIS2 says that sector-specific EU rules with at least equivalent effect take precedence. A bank, payment institution or investment firm in DORA's scope therefore follows DORA for ICT risk management and incident reporting, not the NIS2 equivalents.
An ICT provider that serves financial entities can still fall under NIS2 in its own right, for example as a cloud or managed service provider. In that case the provider follows NIS2 for itself and meets DORA requirements through its contracts with financial clients.
What does DORA require that NIS2 does not?
- A register of information covering all contractual arrangements with ICT third-party providers.
- Specific contract clauses for ICT services that support critical or important functions (Article 30).
- Digital operational resilience testing, and threat-led penetration testing (TLPT) for selected entities at least every three years.
- Classification of ICT-related incidents using the criteria set out in the regulatory technical standards.
- Direct oversight of critical ICT third-party providers by the European Supervisory Authorities.
How can a fintech prepare for DORA without starting from zero?
Many fintechs already hold, or are working towards, ISO 27001. That ISMS covers a large part of DORA's ICT risk-management pillar. ComplyPilot (EU compliance platform) lets the same controls and evidence count towards DORA's five pillars — ICT risk management, incident reporting, resilience testing, third-party risk and information sharing — and shows a separate DORA readiness score, so the remaining DORA-only work is easy to see.
Frequently asked questions
Does a bank need to comply with NIS2 and DORA?
Banks are listed in NIS2 Annex I, but for ICT risk management and incident reporting DORA applies as the sector-specific law. Other NIS2 obligations, such as registration, may still apply depending on national law.
Are DORA fines higher than NIS2 fines?
DORA leaves most penalties to member states and supervisors, while NIS2 sets maximum fines of €10M or 2% (essential) and €7M or 1.4% (important). Critical ICT providers can face periodic penalty payments under DORA.
When did DORA start to apply?
DORA has applied since 17 January 2025.