Since 17 January 2025, DORA and its technical standards apply to banks, insurers, investment firms, payment institutions and the other financial entities it lists. The next deadlines: the 31 December 2026 reference date of the register of information, its transmission to the ESAs by 31 March 2027 (national deadlines come earlier), the yearly update of the critical ICT provider list and the Commission review by 17 January 2028.
DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), is an EU regulation that sets common rules for ICT risk management, ICT-related incident reporting, digital operational resilience testing and ICT third-party risk in the financial sector, together with an EU oversight framework for critical ICT third-party providers. Its details sit in Commission delegated regulations (regulatory technical standards, RTS) and implementing regulations (implementing technical standards, ITS) drafted by the three European Supervisory Authorities: EBA, EIOPA and ESMA ("the ESAs").
The table below lists the dates set by the texts and by supervisors, each with its legal source. Entry into force is the twentieth day after publication in the Official Journal. For an overview of the obligations themselves, see the ResiPlan DORA framework page.
Since when does DORA apply?
DORA was published in the Official Journal on 27 December 2022 (OJ L 333), entered into force on 16 January 2023 and has applied since 17 January 2025 (Article 64). The companion Directive (EU) 2022/2556, which adapts sectoral directives, had to be transposed by the same date (Article 9). There is no phased start: ICT risk management, major incident reporting (Article 19) and the register of information (Article 28(3)) all apply from 17 January 2025. Standards published after that date apply from their own entry into force.
DORA timeline: dates, legal sources and who is concerned
| Date | What happens | Legal source | Who is concerned |
|---|---|---|---|
| 27 December 2022 | DORA and Directive (EU) 2022/2556 published | OJ L 333, 27.12.2022 | All financial entities in scope |
| 16 January 2023 | DORA enters into force | Art. 64 DORA | All financial entities in scope |
| 19 June 2024 | Criteria for designating critical ICT third-party providers, and oversight fees, enter into force | Delegated Regulations (EU) 2024/1502 and 2024/1505 | ICT providers, ESAs |
| 15 July 2024 | RTS enter into force on the ICT risk management framework (and simplified framework), the classification of ICT-related incidents, and the policy on ICT services supporting critical or important functions | Delegated Regulations (EU) 2024/1774, 2024/1772 and 2024/1773 | All financial entities (applicable with DORA) |
| 30 August 2024 | Deadline of the ESAs' voluntary dry run on registers of information (1,039 entities took part) | ESAs dry run report, 17 December 2024 | Volunteer entities |
| 22 December 2024 | ITS on the register of information templates enters into force | Implementing Regulation (EU) 2024/2956 | All financial entities |
| 17 January 2025 | DORA applies; transposition deadline of Directive (EU) 2022/2556 | Art. 64 DORA; Art. 9 Dir. 2022/2556 | All financial entities in scope, Member States |
| 5 March 2025 | RTS on the conditions for conducting oversight activities | Delegated Regulation (EU) 2025/295 | Critical ICT providers, Lead Overseers |
| 12 March 2025 | RTS on the content and time limits of major incident reports, and ITS on reporting forms, enter into force | Delegated Regulation (EU) 2025/301; Implementing Regulation (EU) 2025/302 | All financial entities |
| 31 March 2025 | Reference date of the first registers of information | ESAs Decision of 8 November 2024 (ESA 2024 22) | All financial entities |
| 13 April 2025 | RTS on the composition of joint examination teams | Delegated Regulation (EU) 2025/420 | ESAs, competent authorities |
| 30 April 2025 | Competent authorities send the first registers to the ESAs (the NBB deadline for Belgian entities was also 30 April) | ESAs Decision; NBB | Competent authorities, financial entities |
| 8 July 2025 | RTS on threat-led penetration testing (TLPT) enter into force | Delegated Regulation (EU) 2025/1190 | Entities identified for TLPT |
| 22 July 2025 | RTS on subcontracting ICT services that support critical or important functions | Delegated Regulation (EU) 2025/532 | All financial entities |
| 18 November 2025 | ESAs publish the first list of designated critical ICT third-party providers (19 providers) | Art. 31(9) DORA | Designated providers and their clients |
| 19 November 2025 | Commission proposes the Digital Omnibus, which would route DORA incident reports through a single entry point | COM(2025) 837, procedure 2025/0360(COD) | All financial entities |
| 17 December 2025 | ESAs' joint report to the Commission on statutory auditors (review due by 17 January 2026) | Art. 58(3) DORA; JC 2025 85 | Statutory auditors and audit firms |
| 31 December 2025 | Reference date of the registers reported in 2026 | ESAs Decision | All financial entities |
| 13 to 31 March 2026 | National submission deadlines: NBB 13 March (OneGate), ACPR and CSSF 31 March; authorities report to the ESAs by 31 March | NBB, ACPR, CSSF; ESAs Decision | Financial entities, competent authorities |
| 21 October 2026 | Council agrees its negotiating mandate on the Digital Omnibus; Parliament committees have not yet voted | Council; Legislative Observatory | All financial entities |
| 31 December 2026 | Reference date of the registers reported in 2027 | ESAs Decision | All financial entities |
| 31 March 2027 | Competent authorities send the 2027 registers to the ESAs | ESAs Decision | Competent authorities (entity deadlines earlier) |
| 17 January 2028 | Commission review report on DORA | Art. 58(1) DORA | All |
What are the next DORA deadlines?
From 4 November 2026, in order:
- 31 December 2026: reference date of the register of information. The register filed in 2027 reflects your contractual arrangements at that date.
- Early 2027: national submission window. Each authority sets its own date before 31 March. In 2026 the windows were 16 February to 13 March at the NBB (Belgium, OneGate), 1 January to 31 March at the ACPR (France, OneGate) and 11 February to 31 March at the CSSF (Luxembourg, eDesk). Check your authority's announcement for the 2027 dates.
- By 31 March 2027: transmission to the ESAs by the competent authorities.
- Every year: update of the list of critical ICT third-party providers by the ESAs (Article 31(9)), based on the registers.
- At least every three years: TLPT for the entities identified by their authority (Article 26(1)).
- By 17 January 2028: Commission review covering the designation criteria for critical providers, the voluntary notification of cyber threats, third-country providers and the Joint Oversight Network (Article 58(1)).
Ongoing duties do not wait for these dates: major incidents are reported within the time limits below, and the authority must be told in good time about any planned contract for ICT services supporting a critical or important function (Article 28(3)). The template and the checks for the register are detailed in the ResiPlan guide to the DORA register of information.
What are the deadlines for reporting a major ICT-related incident?
A major ICT-related incident is one with a high adverse impact on the systems that support critical or important functions (Article 3(10) DORA). Under Delegated Regulation (EU) 2024/1772, an incident is major when it affects critical services and either involves a successful, malicious and unauthorised access that may lead to data losses, or meets at least two other materiality thresholds.
| Report | Time limit | Source |
|---|---|---|
| Initial notification | As early as possible, within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it | Art. 5(1)(a), Delegated Regulation (EU) 2025/301 |
| Initial notification after late classification | Within 4 hours of the classification | Art. 5(2) |
| Intermediate report | Within 72 hours of the initial notification, even if nothing has changed; updated without undue delay, and when regular activities are recovered | Art. 5(1)(b) |
| Final report | No later than one month after the intermediate report or its latest update | Art. 5(1)(c) |
| Deadline on a weekend or bank holiday | Noon on the next working day, except initial and intermediate reports of credit institutions, central counterparties, trading venue operators and NIS2 essential or important entities | Art. 5(4) and 5(5) |
| Clients | Informed without undue delay when their financial interests are affected | Art. 19(3) DORA |
Reports use the forms of Implementing Regulation (EU) 2025/302. An entity that cannot meet a time limit must tell its authority before the limit expires and explain why (Article 5(3)). In Belgium, the NBB collects reports through OneGate (DORA_MIR domain, open since 17 January 2025), with a fallback procedure set in circular NBB_2026_04. For the NIS2 sequence of 24 hours, 72 hours and one month, see NIS2 incident notification.
Does the Digital Omnibus change DORA incident reporting?
Not yet. The Commission's proposal of 19 November 2025 (COM(2025) 837) amends Article 19(1) and (2) of DORA so that major incidents and voluntary cyber threat notifications go through a single entry point set up under the NIS2 Directive. It changes the channel, not the time limits of Delegated Regulation (EU) 2025/301. The single entry point would apply 18 months after the regulation enters into force, or 24 months if the Commission finds it not yet reliable.
At 4 November 2026 the text is not adopted. In Parliament, the ITRE and LIBE committees tabled a draft report on 22 June 2026 but had not voted. The Council agreed its mandate on 21 October 2026, preferring national entry points to a single EU entry point. Until a final text is published in the Official Journal, financial entities keep reporting to their competent authority through the existing channels.
Frequently asked questions
Did DORA have a transition period?
No general one. It has applied in full since 17 January 2025. Standards published later apply from their own entry into force, for example 12 March 2025 for the incident report time limits.
When is the next register of information due?
Its reference date is 31 December 2026. Authorities must pass registers to the ESAs by 31 March 2027 and set earlier deadlines for entities: in 2026, 13 March in Belgium and 31 March in France and Luxembourg.
Does a provider's designation as critical change my obligations?
No. Oversight of the 19 designated providers is carried out by the ESAs; each financial entity remains fully responsible for its own compliance (Article 28(1)(a)).
Are DORA and NIS2 reporting deadlines the same?
No. DORA asks for an initial notification within 4 hours of classification (24 hours at most after detection), then 72 hours and one month. NIS2 starts with an early warning within 24 hours of becoming aware of a significant incident.
Has the Digital Omnibus been adopted?
No. At 4 November 2026 it is still being negotiated, and current DORA reporting rules apply.
Sources
- Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2556
- Delegated Regulations (EU) 2024/1502, 2024/1505, 2024/1772, 2024/1773, 2024/1774, 2025/295, 2025/301, 2025/420, 2025/532, 2025/1190
- Implementing Regulations (EU) 2024/2956 and 2025/302
- ESAs – DORA RoI reporting FAQ (deadlines and reference dates), 28 March 2025
- ESAs – Dry run results, 17 December 2024
- ESAs – Designation of critical ICT third-party providers, 18 November 2025 and the list
- ESAs – Joint report JC 2025 85 under Article 58(3)
- Commission proposal COM(2025) 837 (Digital Omnibus) and procedure file 2025/0360(COD)
- Council – Position on the digital rulebook, 21 October 2026
- NBB – OneGate DOR domain (DORA_ROI, DORA_MIR)
- ACPR – DORA webinar of 23 January 2026
- CSSF – Register of information submission timeframe 2026