DORA compliance: the five pillars and the articles behind each

DORA (the Digital Operational Resilience Act, Regulation (EU) 2022/2554) states its scope in Article 1 as a list, not as pillars. Industry guides group that list into five workstreams because one item, the contractual arrangements with ICT providers, is the operative detail behind another, third-party risk. Below is the Regulation's own breakdown with the article that carries each area, as Rekvira returned it on 24 September 2026.

What does Article 1 list?

"... this Regulation lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities as follows: (a) requirements applicable to financial entities in relation to: (i) information and communication technology (ICT) risk management; (ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the competent authorities; (iii) reporting of major operational or security payment-related incidents ...; (iv) digital operational resilience testing; (v) information and intelligence sharing in relation to cyber threats and vulnerabilities; (vi) measures for the sound management of ICT third-party risk; (b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities" (Article 1(1))

How do the five pillars map to the Regulation?

Who owns the risk management framework?

Not IT. Article 5(2) puts it on the management body, which must "bear the ultimate responsibility for managing the financial entity's ICT risk", set roles, approve the digital operational resilience strategy and the ICT business continuity policy, and approve the ICT internal audit plans. A framework that the board has never approved does not meet the Article, however good the controls are.

How are incidents reported?

Article 19(4) sets a three-step sequence for a major ICT-related incident: an initial notification, intermediate reports "as soon as the status of the original incident has changed significantly", and a final report "when the root cause analysis has been completed". The deadlines themselves are set in technical standards under Article 20, which the Regulation's own text does not contain.

How often must you test?

Microenterprises are outside the yearly test rule, and the competent authority may shorten or lengthen the three-year TLPT cycle "based on the risk profile of the financial entity" (Article 26(1)).

Why does third-party risk carry so much weight?

Because the responsibility does not move with the service. Article 28(1)(a) says a financial entity that uses ICT services under contract "shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation". Whatever the provider signs, the supervisor looks at you. That is why the contract clauses in Article 30 (service levels, locations, audit rights, exit strategies) and the register of information in Article 28(3) get a workstream of their own.

The recorded DORA third-party contract review shows what that looks like in practice: an assistant connected to Rekvira checks an illustrative cloud contract clause by clause against Articles 28 and 30, quoting each requirement.

When did DORA take effect?

On one date, with no phased schedule of the kind the AI Act uses: "It shall apply from 17 January 2025" (Article 64). All five workstreams above have been binding on financial entities since then.