The difference between DORA and NIS2 for financial institutions is a matter of precedence. DORA is a sector-specific regulation: for banks and other financial entities, its ICT risk, incident reporting, testing and third-party rules apply instead of NIS2's. Banks and market infrastructures still appear in NIS2, and their incident reports still reach NIS2 authorities. Below, one table compares DORA, NIS2, the CRA and the AI Act.
In EU law, lex specialis means that a more specific act applies instead of a general one on the same subject. NIS2 sets the rule in Article 4 and DORA triggers it in Article 1(2). The Cyber Resilience Act (CRA) is a product regulation for connected hardware and software, and the AI Act is a risk-based regulation for AI systems and general-purpose AI models. Both apply alongside DORA and NIS2, not instead of them.
This page is the four-text overview. For a deeper analysis of DORA and NIS2 alone, read DORA vs NIS2.
DORA, NIS2, CRA and AI Act side by side
| DORA | NIS2 | CRA | AI Act | |
|---|---|---|---|---|
| Legal form and reference | Regulation (EU) 2022/2554, directly applicable. Detailed rules in technical standards, e.g. Delegated Regulations (EU) 2024/1772, 2025/301 and 2025/1190, Implementing Regulation (EU) 2024/2956 | Directive (EU) 2022/2555. It applies through national transposition laws, so details differ by Member State | Regulation (EU) 2024/2847, directly applicable | Regulation (EU) 2024/1689, directly applicable. Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI) |
| Who is in scope | 20 types of financial entities (Art. 2(1)(a)–(t)): credit, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, pension funds, fund managers, market infrastructures and others. ICT third-party service providers through contracts and, if designated critical, through direct EU oversight | Medium-sized and large entities (some regardless of size) in 18 sectors listed in Annexes I and II, classed as essential or important. Banking and financial market infrastructures are in Annex I | Manufacturers, importers and distributors of products with digital elements that have a data connection to a device or network (Art. 2(1)). Cloud and SaaS fall under NIS2 instead, unless they are a product's remote data processing (recitals 11–12) | Providers, deployers, importers and distributors of AI systems, and providers of general-purpose AI models, including non-EU providers whose output is used in the EU (Art. 2(1)) |
| What it protects | Digital operational resilience of financial entities and the financial system | Security of the network and information systems behind services that matter to society and the economy | Cybersecurity of products over their whole lifecycle, including the support period | Health, safety and fundamental rights exposed to AI risks |
| Core obligations | ICT risk management framework (Art. 5–16), incident management and classification (Art. 17–18), resilience testing (Art. 24–27), ICT third-party risk, including the register of information (Art. 28(3)) and contract clauses (Art. 30) | Governance (Art. 20) and an all-hazards set of at least ten risk-management measures (Art. 21(2)(a)–(j)), from incident handling and business continuity to supply chain security and multi-factor authentication | Essential cybersecurity requirements (Annex I, Part I), vulnerability handling with a software bill of materials (SBOM) (Annex I, Part II), conformity assessment and CE marking | Prohibited practices (Art. 5), AI literacy measures (Art. 4), requirements for high-risk systems (Art. 9–15), deployer duties (Art. 26), fundamental rights impact assessment (Art. 27), transparency (Art. 50), duties for general-purpose AI models (Art. 53–55) |
| Incident or vulnerability reporting and deadlines | Major ICT-related incidents, reported to the financial supervisor. Initial notification within 4 hours of classification as major and no later than 24 hours after becoming aware. Intermediate report within 72 hours of the initial notification. Final report within 1 month of the latest intermediate report (Art. 19; Delegated Regulation (EU) 2025/301, Art. 5) | Significant incidents, reported to the CSIRT or competent authority. Early warning within 24 hours of becoming aware. Incident notification within 72 hours. Intermediate report on request. Final report within 1 month of the notification (Art. 23(4)) | Actively exploited vulnerabilities and severe incidents, reported by the manufacturer through ENISA's Single Reporting Platform. Early warning within 24 hours. Notification within 72 hours. Final report 14 days after a fix is available (vulnerability) or 1 month after the notification (incident) (Art. 14) | Serious incidents involving high-risk AI systems, reported by the provider to the market surveillance authority. Report as soon as a causal link is established, and within 15 days at most. Within 2 days for a widespread infringement or a serious disruption of critical infrastructure. Within 10 days in case of death (Art. 73) |
| Management body liability | The management body defines, approves and oversees the ICT risk framework and bears ultimate responsibility for ICT risk (Art. 5(2)). Regular training (Art. 5(4)). National penalties can reach board members (Art. 50(5)) | Management bodies approve and oversee the Art. 21 measures and can be held liable (Art. 20(1)). Mandatory training (Art. 20(2)). For essential entities, a temporary ban from managerial functions is possible (Art. 32(5)(b)) | No provision specific to the board. Obligations sit with the economic operator | No provision specific to the board. Providers and deployers must take AI literacy measures for their staff (Art. 4) |
| Third-party and supply chain | ICT third-party risk strategy, register of information (Art. 28(3); Implementing Regulation (EU) 2024/2956), mandatory contract clauses (Art. 30), exit strategies. The ESAs oversee critical ICT third-party service providers (Art. 31–44) and published their initial list of designated providers on 18 November 2025 | Supply chain security, covering relationships with direct suppliers and the quality of their products and development practices (Art. 21(2)(d) and 21(3)). EU coordinated risk assessments of critical supply chains (Art. 22) | Due diligence on third-party components, including open-source ones (Art. 13(5)). SBOM covering at least top-level dependencies. Obligations for importers (Art. 19) and distributors (Art. 20) | Obligations shared along the AI value chain (Art. 25). The provider of a high-risk system and its suppliers of models, tools and components must sign a written agreement (Art. 25(4)), which Regulation (EU) 2026/1744 added to the fineable obligations (Art. 99(4)(da)) |
| Testing | Resilience testing programme for all entities (Art. 24–25). Threat-led penetration testing at least every 3 years for identified entities (Art. 26; Delegated Regulation (EU) 2025/1190) | Procedures to assess whether the measures work (Art. 21(2)(f)). Authorities can order audits and security scans (Art. 32(2)) | Effective and regular security tests and reviews (Annex I, Part II, point 3). Third-party conformity assessment for some product categories (Art. 32) | Testing of high-risk systems before they are placed on the market (Art. 9). Accuracy, robustness and cybersecurity (Art. 15). Adversarial testing of general-purpose AI models with systemic risk (Art. 55) |
| Penalties (maximum fines) | Amounts set by national law (Art. 50); no EU ceiling for financial entities. For critical ICT providers, a periodic penalty payment of up to 1% of average daily worldwide turnover, per day, for up to 6 months (Art. 35(6)–(8)) | Essential entities: maximum of at least €10 million or 2% of worldwide annual turnover, whichever is higher. Important entities: at least €7 million or 1.4% (Art. 34(4)–(5)). National laws may set higher maximums | €15 million or 2.5% (essential requirements, Art. 13 and 14). €10 million or 2% (other listed obligations). €5 million or 1% (incorrect or misleading information). Whichever is higher (Art. 64) | €35 million or 7% (prohibited practices). €15 million or 3% (most other obligations, including transparency). €7.5 million or 1% (incorrect information). Whichever is higher; whichever is lower for SMEs, and since 2026 for small mid-caps outside prohibited practices (Art. 99). The Commission fines general-purpose AI model providers up to €15 million or 3% (Art. 101) |
| Supervisory authorities | National financial supervisors (Art. 46), for example the NBB and FSMA in Belgium. For significant credit institutions, reports are passed on to the ECB. The ESAs (EBA, EIOPA, ESMA) act as Lead Overseers of critical ICT providers | National competent authorities, CSIRTs and single points of contact, for example the CCB in Belgium. Cooperation Group and CSIRTs network at EU level | National market surveillance authorities (Art. 52). Reports go to CSIRTs designated as coordinators and to ENISA. Notified bodies carry out third-party assessments | National market surveillance authorities. For AI used by financial institutions to provide financial services, the financial supervisor (Art. 74(6)). The AI Office (Commission) supervises general-purpose AI models |
| Application dates | In force 16 January 2023; applies from 17 January 2025 (Art. 64) | In force 16 January 2023; transposition deadline 17 October 2024, national measures applicable from 18 October 2024 (Art. 41) | In force 10 December 2024. Notified bodies chapter: 11 June 2026. Reporting (Art. 14): 11 September 2026. Everything else: 11 December 2027 (Art. 71) | In force 1 August 2024. Prohibitions and AI literacy: 2 February 2025. General-purpose AI models and penalties: 2 August 2025. General date, including transparency: 2 August 2026. High-risk systems: 2 December 2027 (Annex III) and 2 August 2028 (Annex I), as amended in 2026 |
What changed in 2025 and 2026: law or proposal?
| Item | Status on 4 November 2026 |
|---|---|
| Digital Omnibus on AI, Regulation (EU) 2026/1744 | Law. Published on 24 July 2026, in force since 27 July 2026. It moves the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It replaces Article 10(5) with a new Article 4a on bias detection. AI literacy becomes a duty to "take measures to support" it. A fundamental rights impact assessment can cross-refer to the DPIA. Two new prohibitions, on AI systems that generate non-consensual intimate images of identifiable people or child sexual abuse material, apply from 2 December 2026 |
| CRA reporting (Art. 14) | Applies since 11 September 2026, through ENISA's Single Reporting Platform. It covers products already on the market (Art. 69(3)) |
| DORA oversight of critical ICT providers | In operation. The ESAs published their initial list of designated providers on 18 November 2025 |
| Digital Omnibus on data and incident reporting, COM(2025) 837, procedure 2025/0360(COD) | Proposal. The Commission (19 November 2025) proposed a single entry point run by ENISA for incident reports under NIS2, GDPR, DORA, eIDAS and CER. Personal data breaches would be notified only if high-risk, within 96 hours. On 21 October 2026, the Council agreed its negotiating mandate that replaces the EU-level entry point with national entry points. The Parliament has not adopted its position. Until the text is adopted, every report keeps its own channel and deadline (for example GDPR: 72 hours) |
| Targeted NIS2 amendments, COM(2026) 13, procedure 2026/0012(COD) | Proposal (January 2026, part of the Cybersecurity Act revision package). The Parliament is still at committee stage |
What is the difference between DORA and NIS2 for financial institutions?
NIS2 Article 4(1) says that where a sector-specific Union act imposes cybersecurity risk management or incident notification duties "at least equivalent in effect", the corresponding NIS2 provisions, including supervision and enforcement, do not apply. DORA Article 1(2) declares itself such an act for financial entities identified under NIS2. NIS2 recital 28 says so explicitly: DORA's rules on ICT risk management, incident reporting, testing, information sharing and third-party risk apply instead.
What NIS2 still means for a bank or a market infrastructure:
- It stays within NIS2 on paper. Banking and financial market infrastructures are Annex I sectors, and DORA Article 1(2) is written for financial entities identified under national NIS2 rules. How each Member State handles that identification varies.
- Its reports still reach cyber authorities. The financial supervisor forwards DORA incident reports to NIS2 CSIRTs, competent authorities or single points of contact (DORA Art. 19(6)(c)). Member States may also require a copy to be sent directly (Art. 19(1)).
- No weekend extension. Credit institutions, central counterparties, trading venues and any other financial entity identified under NIS2 cannot postpone the initial notification or intermediate report to the next working day (Delegated Regulation (EU) 2025/301, Art. 5(5)).
- The group may still be under NIS2. Non-financial subsidiaries, such as an in-house ICT services company, follow their national NIS2 law, and so do many of the bank's suppliers (cloud, data centres, managed services).
- Supervisors cooperate. When NIS2 authorities supervise an entity that is also a designated critical ICT provider, they inform the DORA Oversight Forum (NIS2 Art. 32(10) and 33(6)).
More detail: DORA framework and NIS2 framework.
What is the difference between the Cyber Resilience Act and NIS2?
NIS2 regulates entities: how an organisation secures the networks and systems behind its services. The CRA regulates products: what a manufacturer may place on the EU market and how it maintains it. Many organisations face both, and the two texts are built to interlock:
- Shared vocabulary and channels. The CRA borrows NIS2's definitions of "incident" and "near miss". CRA reports go to the CSIRTs designated as coordinators under NIS2 Article 12(1), as well as to ENISA.
- Supply chain. NIS2 requires entities to consider each direct supplier's vulnerabilities, product quality and secure development practices (Art. 21(3)). CRA recital 24 says that secure-by-design products with timely security updates are meant to help entities meet these NIS2 supply chain requirements. In practice, a CE-marked product, an SBOM and a declared support period become procurement evidence.
- Certification. Under NIS2 Article 24, Member States may require essential and important entities to use ICT products certified under European schemes. Under CRA Article 8, the Commission may require a European cybersecurity certificate for critical products (Annex IV). Both rely on schemes adopted under the Cybersecurity Act (Regulation (EU) 2019/881).
- Cloud and SaaS. NIS2 covers cloud services such as SaaS, PaaS and IaaS. The CRA covers remote processing only when a product needs it to work (CRA recitals 11–12).
- Double exposure. A medium-sized or large manufacturer of computer, electronic and optical products falls under NIS2 (Annex II) and is also a CRA manufacturer. An attack that exploits a flaw in its product and hits its own network can trigger both a CRA report (Art. 14) and a NIS2 report (Art. 23).
For contracts with digital product suppliers, see CRA contract clauses.
How do the EU AI Act and the GDPR interact?
The GDPR keeps applying in full. AI Act Article 2(7), as replaced by Regulation (EU) 2026/1744, states that Union data protection law applies and that the AI Act "shall not affect" the GDPR, without prejudice to Article 4a and Article 59 (sandboxes). An AI Act deployer is usually also a GDPR controller, so the legal basis, transparency and data subject rights rules still apply.
Special categories for bias detection. Article 10(5) let providers of high-risk systems process special categories of personal data, where strictly necessary to detect and correct bias, under six cumulative safeguards: pseudonymisation, no transmission to other parties, deletion once the bias is corrected and a recorded reason why other data would not do, among others. Regulation (EU) 2026/1744 moved this legal basis to a new Article 4a, applicable since 27 July 2026. Paragraph 1 keeps the conditions for high-risk providers. Paragraph 2 extends the basis to providers and deployers of other AI systems and models, and to deployers of high-risk systems, with the same safeguards and the same "strictly necessary" test. It creates no obligation to run bias detection.
DPIA and FRIA. Deployers of high-risk systems use the provider's instructions (Art. 13) for their GDPR data protection impact assessment (DPIA) (Art. 26(9) AI Act, Art. 35 GDPR). Article 27 adds a fundamental rights impact assessment (FRIA), carried out before deployment, for public bodies, private entities providing public services, and deployers of Annex III point 5(b) and (c) systems: creditworthiness and credit scoring, and risk assessment and pricing in life and health insurance. Banks and insurers are therefore directly concerned. Since 2026, the FRIA may cross-refer to the DPIA or reuse parts of it (Art. 27(4)), and the AI Office is to provide a questionnaire template (Art. 27(5)). The FRIA applies from 2 December 2027 for Annex III systems.
What the EDPB says. Statement 3/2024 (16 July 2024) recommends designating data protection authorities as market surveillance authorities for the high-risk systems listed in Article 74(8). Opinion 28/2024 (17 December 2024) says that AI models trained on personal data are not always anonymous and sets out a three-step test for legitimate interest. Joint Opinion 1/2026 with the EDPS (21 January 2026) asked to keep the bias-detection extension narrow. The adopted Article 4a keeps the "strictly necessary" test.
Still a proposal: the GDPR amendments of the Digital Omnibus COM(2025) 837, including a derogation for residual processing of special categories during AI development (see the status table above).
Where do the four texts overlap for a company subject to several?
Take a financial group that sells a connected software product, uses an AI credit-scoring system and relies on cloud providers.
One incident, several reports. A ransomware attack exploits a flaw in the group's own product, disrupts payments and exposes customer data. That single event can start up to four clocks:
| Report | Recipient | Earliest deadline |
|---|---|---|
| DORA major ICT-related incident | Financial supervisor, which forwards it to NIS2 authorities | 4 hours after classification, at most 24 hours after awareness |
| GDPR personal data breach | Data protection authority | 72 hours, unless the breach is unlikely to result in a risk (Art. 33) |
| CRA actively exploited vulnerability or severe incident | CSIRT coordinator and ENISA, through the Single Reporting Platform | 24 hours |
| AI Act serious incident (from 2 December 2027, if a high-risk system it provides is involved) | Market surveillance authority, which is the financial supervisor for financial services (Art. 74(6)) | 15 days at most, shorter in some cases |
Two rules limit double penalties: NIS2 Article 35(2) rules out a NIS2 fine for conduct already fined under the GDPR, and AI Act Article 99(7)(c) requires fines imposed by other authorities for the same activity to be taken into account. AI Act Article 73(9) also limits reporting for Annex III systems to fundamental-rights infringements where the provider already reports under equivalent Union rules. Whether DORA counts as equivalent has to be assessed case by case.
One risk framework. The texts reward a single control base:
- Use the DORA ICT risk management framework (Art. 6) as the backbone. It can host the NIS2 Article 21 measures for non-financial group entities, the product security process the CRA requires, and the AI Act risk management system (Art. 9).
- Rely on the financial-sector equivalences built into the AI Act. Financial institutions meet the AI Act quality management system (Art. 17(4)) and deployer monitoring duty (Art. 26(5)) largely through their financial-services governance rules.
- Keep one supplier inventory. The DORA register of information (Art. 28(3)) can also record NIS2 supplier assessments, the written agreements required by AI Act Article 25(4) and the SBOMs received under the CRA.
- Write one incident playbook with a classification step per text and the clocks above.
ResiPlan assesses each control once and maps it across DORA, NIS2, CRA, GDPR and other frameworks: compliance frameworks.
FAQ
Does a bank have to report the same incident under both DORA and NIS2?
No. It reports under DORA to its financial supervisor, which passes the report on to NIS2 authorities (DORA Art. 19(6)). A Member State may additionally require a direct copy. A GDPR breach notification remains separate.
Does the Cyber Resilience Act apply to SaaS?
Generally not. NIS2 covers cloud services, including SaaS. The CRA covers remote data processing only when a product needs it to perform one of its functions.
Are the AI Act high-risk obligations postponed?
Yes, by law. Regulation (EU) 2026/1744 sets 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Prohibitions, AI literacy, rules for general-purpose AI models and transparency (Art. 50) already apply. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to mark their outputs (Art. 50(2) and 111(4)).
Is there a single EU portal for incident reports?
Not yet. ENISA's Single Reporting Platform serves CRA manufacturer reports only. The single entry point for NIS2, GDPR, DORA and other reports is still a proposal (COM(2025) 837), and the Council wants national entry points instead.
How do the maximum fines compare?
The AI Act goes up to €35 million or 7% of worldwide turnover for prohibited practices. Next come the GDPR (€20 million or 4%), the CRA (€15 million or 2.5%) and NIS2 (at least €10 million or 2% for essential entities). DORA leaves amounts for financial entities to national law.
Sources
- Regulation (EU) 2022/2554 (DORA), Art. 1, 2, 5, 19, 26, 28, 30, 35, 46, 50, 64
- Delegated Regulation (EU) 2025/301 (incident report content and time limits), Art. 5
- Delegated Regulation (EU) 2024/1772 (incident classification)
- Delegated Regulation (EU) 2025/1190 (threat-led penetration testing)
- Implementing Regulation (EU) 2024/2956 (register of information templates)
- ESAs: designation of critical ICT third-party providers, 18 November 2025
- Directive (EU) 2022/2555 (NIS2), recital 28, Art. 4, 20, 21, 23, 24, 32–35, 41, Annexes I and II
- Regulation (EU) 2024/2847 (Cyber Resilience Act), recitals 11, 12, 24, Art. 2, 8, 13, 14, 64, 69, 71, Annex I
- ENISA: CRA Single Reporting Platform
- European Commission: CRA reporting obligations
- Regulation (EU) 2024/1689 (AI Act), Art. 2, 17, 25–27, 73, 74, 99, 101, 113, Annex III
- Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- Regulation (EU) 2016/679 (GDPR), Art. 33, 35, 83
- Commission proposal COM(2025) 837 (Digital Omnibus) and European Parliament procedure file 2025/0360(COD)
- European Parliament procedure file 2026/0012(COD) (targeted NIS2 amendments)
- EDPB Statement 3/2024 on data protection authorities' role in the AI Act framework
- EDPB Opinion 28/2024 on AI models
- EDPB and EDPS: Joint Opinion 1/2026 on the Digital Omnibus on AI, press release of 21 January 2026