DORA in 2026: what the ESAs say about year two

This post sets out what two European supervisory pages say about the Digital Operational Resilience Act (DORA) in 2026. The sources are the ESMA page on DORA and the EIOPA page on DORA, which is dated 17 July 2026. Both are overviews: they list what DORA covers, the technical standards and the documents the European Supervisory Authorities (ESAs) have published. This post states no incident reporting deadlines.

What is DORA, and when did it start to apply?

The ESMA page describes DORA as an EU regulation that aims at strengthening the information and communication technology (ICT) security of financial entities. It says DORA entered into force on 16 January 2023 and applies as of 17 January 2025. The EIOPA page, dated 17 July 2026, says DORA entered into application on 17 January 2025.

On scope, the ESMA page says DORA applies to more than 20 different types of financial entities, of which 12 are in the remit of ESMA. The EIOPA page lists banks, insurance companies and investment firms among them, and says the rules also apply to ICT third-party service providers. For the basics, see our earlier post on the Digital Operational Resilience Act and the DORA glossary entry.

What does DORA cover?

Both pages group the rules into areas. The ESMA page names ICT risk management, ICT third-party risk management, digital operational resilience testing, ICT-related incidents, information sharing, and oversight of critical third-party providers. The diagram restates them.

The ESMA page ties areas to articles. Risk management is listed under Arts. 5-16 and 26-30, incident reporting under Arts. 17-23, and the oversight framework under Arts. 31-44.

Which technical standards sit under the regulation?

The ESMA page says DORA requirements are set out across Level 1 legislation, Level 2 technical standards and delegated regulations, and Level 3 supervisory guidance. Level 1 is Regulation (EU) 2022/2554 and an amending Directive, Directive (EU) 2022/2556.

The Level 2 list on the EIOPA page includes RTS on ICT risk management, ICT incident classification, incident reporting and threat-led penetration testing (TLPT), an RTS on subcontracting, and an ITS on the register of information. The ESMA page also lists an ITS on standard forms and templates for reporting a major ICT-related incident and for notifying a significant cyber threat. Level 3 includes guidelines on oversight cooperation and on estimating aggregated annual costs and losses caused by major ICT-related incidents.

What have the ESAs published since 2024?

The ESMA page keeps a dated list of joint ESAs documents. The EIOPA page links to the Commission’s rejection letter of the ITS on the register of information, and to the ESAs’ responses to the Commission’s rejection of that ITS and of the RTS on subcontracting. The ESMA list dates the related ESAs Opinions at 15 October 2024 (register of information) and 7 March 2025 (subcontracting).

Later entries on the ESMA list are dated in 2025 and 2026:

• 14 May 2025: “Preparing for the DORA Oversight Framework: CTPP Designation and Next Steps”.
• 17 December 2025: a Joint ESAs Report in response to the European Commission consultation under Article 58(3) of DORA.
• 3 June 2026: the 2025 ESAs Report on major ICT-related incidents.
• 31 July 2026: an ESAs statement toward a consistent and risk-based approach for ICT risks from frontier AI models.

These are titles and dates from the list. We have not summarized the documents. For how DORA sits beside NIS2 on suppliers, see our post on NIS2 and DORA third-party risk management.

What do the pages say about critical ICT third-party providers?

The EIOPA page says DORA establishes an EU-wide oversight framework for critical ICT third-party providers (CTPPs) to ensure that the financial sector remains secure and resilient against ICT disruptions. It adds that the framework helps to address potential systemic and concentration risks arising from the financial sector’s reliance on a limited number of ICT providers.

On designation, the ESMA list includes a decision on the information that competent authorities must report to the ESAs for the designation of critical providers, dated 8 November 2024 and updated on 29 January 2025. The EIOPA page links a roadmap for CTPP designation. This post does not name any provider.

What can a team check against these pages?

The pages give no advice of their own, so the points below are questions drawn from the facts above, not recommendations from the ESAs.

• The ESMA page lists an ITS on standard templates for the register of information. Is your register of ICT arrangements ready to be reported in that form?
• The standards refer to ICT services supporting critical or important functions. Which of your providers support such functions, and who are their subcontractors?
• The ESMA page lists an RTS on the implementation of TLPT. Which of your entities would that standard apply to?
• The incident rules sit in Arts. 17-23 with their own standards and an operational instructions document. Have your incident teams read them?

For the wider calendar of EU and other duties, see our posts on cyber security regulations to know in 2026 and the cyber compliance calendar for 2026 and 2027. This is a summary of what two public pages say, not legal advice. Check with counsel how DORA applies to your organization.

Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.

For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.

To go further, read the incident reporting deadlines and NIS2 transposition status.