Policy Briefing — Digital Operational Resilience Act enters into force
On 16 January 2023 the EU’s Digital Operational Resilience Act (DORA) took effect, starting a phased timeline for financial entities and critical ICT providers to meet governance, testing, and third-party risk obligations.
The Digital Operational Resilience Act (DORA) entered into force on 16 January 2023, 20 days after publication in the EU Official Journal. Banks, insurers, investment firms, and ICT service providers now have two years to align with harmonized EU rules on ICT risk management, incident reporting, digital operational resilience testing, and oversight of critical third-party vendors.
Program leads should map existing frameworks against the act’s five pillars—governance, risk management, incident classification and reporting, testing, and third-party risk—to prioritize gaps. Contracts with ICT providers may need renegotiation to meet new oversight and concentration requirements before the supervisory framework is fully operational.
- Regulation text details timelines, ICT testing expectations, incident thresholds, and oversight powers for critical providers.
- Commission notice confirms the effective date and scope, underscoring the two-year implementation runway.
Continue in the Policy pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Semiconductor Industrial Strategy Policy Guide — Zeph Tech
Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.
-
Digital Markets Compliance Guide — Zeph Tech
Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…
-
Export Controls and Sanctions Policy Guide — Zeph Tech
Integrate U.S. Export Control Reform Act, International Emergency Economic Powers Act, and EU Dual-Use Regulation requirements into trade compliance, engineering, and supplier…