EU DORA deadlines and compliance calendar

Start the calendar with the legal application date and the implementation instruments that change how teams report or maintain evidence. DORA was published in the Official Journal on 27 December 2022, entered into force on 16 January 2023, and applies from 17 January 2025.

For evidence planning, keep separate calendar rows for the 2024 register templates, the 2025 major incident reporting RTS and ITS, the 2025 TLPT criteria RTS, and the ESA publication of the first list of designated critical ICT third-party providers. These milestones do not replace entity-specific supervisory submissions, but they explain which template, clock, or oversight framework the entity should be using.

Do not calendar major incident reporting as a single annual date. Calendar it as a playbook clock that starts when an ICT-related incident is detected, assessed, and classified as major under the DORA incident-classification rules.

Delegated Regulation (EU) 2025/301 sets the time limits. The initial notification is due as early as possible, within four hours from classification as major, and no later than 24 hours from when the financial entity became aware of the incident. If the entity classifies the incident as major only after the first 24 hours, the initial notification is due within four hours from that later classification. The intermediate report is due within 72 hours from the initial notification. The final report is due no later than one month after the intermediate report, or after the latest updated intermediate report.

The register calendar has two layers: an always-current operational register and the reporting rhythm required by DORA. DORA requires financial entities to maintain and update, at entity level and at sub-consolidated and consolidated levels, a register of information for all contractual arrangements on the use of ICT services provided by ICT third-party service providers.

DORA also requires at least yearly reporting to competent authorities on new ICT service arrangements, provider categories, contractual arrangement types, and the ICT services and functions provided. The register should therefore be updated when a contract starts, changes, ends, a supporting function becomes critical or important, or a subcontracting chain changes, and reviewed before the annual reporting cycle.

DORA creates both general resilience-testing cadence and advanced TLPT cadence. Financial entities other than microenterprises must ensure, at least yearly, appropriate tests on all ICT systems and applications supporting critical or important functions. Article 16 entities and microenterprises are outside the TLPT duty. Other financial entities identified by the competent or designated TLPT authority must carry out advanced testing by means of TLPT at least every three years, unless the competent authority changes the frequency based on risk profile and operational circumstances.

For TLPT, the compliance calendar should start when the TLPT authority notifies the financial entity that a TLPT is to be carried out. Delegated Regulation (EU) 2025/1190 then creates planning and closure dependencies: initiation information within three months of that notification, scope specification within six months, active red team testing lasting at least 12 weeks, a red team report within four weeks after active testing ends, and the blue team report, replay, and purple teaming no later than 10 weeks after active testing ends. After the TLPT authority confirms that the red and blue team reports contain the required information, the financial entity has eight weeks to submit both the summary report and the remediation plan and supporting documentation.

The ESA designation of a critical ICT third-party service provider does not create a new general filing deadline for every customer financial entity. It starts an EU oversight relationship between the designated provider and its Lead Overseer. Financial entities should still track the designation because supervisory recommendations to a provider can affect service risk, remediation, and, as a last resort, continued use of the service.

A designated provider has 60 calendar days after receiving a Lead Overseer recommendation to state that it intends to follow the recommendation or give a reasoned explanation for not doing so. Separately, if the provider does not comply with a Lead Overseer information request, investigation, or inspection measure, a periodic penalty-payment decision can follow only after at least 30 calendar days from notification of that measure. Both clocks apply to provider oversight; the major-incident reporting clocks apply to financial entities.

Each DORA calendar row should show the date or trigger, legal source, responsible owner, required evidence, and any authority or template dependency.

Use separate row types for fixed milestones, event-triggered clocks, recurring reviews, authority-request items, and template-maintenance changes. That separation prevents teams from treating incident reports, register updates, and TLPT cycles as the same kind of deadline.