EU DORA deadlines and compliance calendar

Start the calendar with the legal application date and the implementation instruments that change how teams report or maintain evidence. DORA was published in the Official Journal on 27 December 2022, entered into force on 16 January 2023, and applies from 17 January 2025.

For evidence planning, keep separate calendar rows for the 2024 register templates, the 2025 major incident reporting RTS and ITS, the 2025 TLPT criteria RTS, and the ESA publication of the first list of designated critical ICT third-party providers. These milestones do not replace entity-specific supervisory submissions, but they explain which template, clock, or oversight framework the entity should be using.

Do not calendar major incident reporting as a single annual date. Calendar it as a playbook clock that starts when an ICT-related incident is detected, assessed, and classified as major under the DORA incident-classification rules.

Delegated Regulation (EU) 2025/301 sets the time limits. The initial notification is due as early as possible, within four hours from classification as major, and no later than 24 hours from when the financial entity became aware of the incident. If the entity classifies the incident as major only after the first 24 hours, the initial notification is due within four hours from that later classification. The intermediate report is due within 72 hours from the initial notification. The final report is due no later than one month after the intermediate report, or after the latest updated intermediate report.

The register calendar has two layers: an always-current operational register and the reporting rhythm required by DORA. DORA requires financial entities to maintain and update, at entity level and at sub-consolidated and consolidated levels, a register of information for all contractual arrangements on the use of ICT services provided by ICT third-party service providers.

DORA also requires at least yearly reporting to competent authorities on new ICT service arrangements, provider categories, contractual arrangement types, and the ICT services and functions provided. The register should therefore be updated when a contract starts, changes, ends, a supporting function becomes critical or important, or a subcontracting chain changes, and reviewed before the annual reporting cycle.

DORA creates both general resilience-testing cadence and advanced TLPT cadence. Financial entities other than microenterprises must ensure, at least yearly, appropriate tests on all ICT systems and applications supporting critical or important functions. Identified financial entities must also carry out advanced testing by means of TLPT at least every three years, unless the competent authority changes the frequency based on risk profile and operational circumstances.

For TLPT, the compliance calendar should start when the TLPT authority notifies the financial entity that a TLPT is to be carried out. Delegated Regulation (EU) 2025/1190 then creates planning and closure dependencies: initiation information within three months of notification, scope specification within six months of notification, active red team testing lasting at least 12 weeks, red team report within four weeks after active testing ends, blue team report and replay/purple teaming no later than 10 weeks after active testing ends, and the summary report and remediation documentation within eight weeks of the relevant TLPT authority notification.

A useful DORA calendar should not be a list of dates alone. Each row should show which legal source created the obligation, what event starts the clock, who owns the response, what evidence must exist, and what authority or template dependency applies.

Use separate row types for fixed milestones, event-triggered clocks, recurring reviews, authority-request items, and template-maintenance changes. That separation prevents teams from treating incident reports, register updates, and TLPT cycles as the same kind of deadline.