FAQEU

EU DORA FAQ

Fast answers to the real questions compliance, security, and product teams ask about DORA.

Grounded in the Regulation and the key RTS/ITS for reporting, contracting, and RoI templates.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

This FAQ is designed to be operational: each answer points to what to implement next and what evidence to keep. For formal interpretation and edge cases, validate against the primary legal texts and your competent authority guidance.

Question 1

When does DORA apply?

DORA applies from 17 January 2025 (Article 64). It entered into force 20 days after its publication in the Official Journal (OJ L 333, 27.12.2022).

Most readiness work (RoI, reporting pipeline, third-party clauses, testing program) should be built as a program - not a last-minute checklist.

Practical timeline: 90-180 days to build core workflows + exports, then quarterly drills and continuous improvement.
If you can't export the RoI reliably, start there - it unlocks third-party supervision readiness.

Question 2

Who is in scope (and what does "critical or important functions" mean)?

DORA covers a defined set of financial entities and sets stricter expectations for ICT services supporting critical or important functions.

Operationally, treat "critical or important" as a service classification tag applied in your service catalog and architecture. It drives stricter contracting, monitoring, subcontracting governance, and exit planning.

Build a function catalog + service mapping so you can explain which ICT services support which functions.
Use that mapping to prioritize: third-party clause remediation, subcontracting assessments, and exit readiness work.

Question 3

What is the Register of Information (RoI) and why do supervisors care?

The RoI is a DORA supervisory artifact: a register of contractual arrangements on ICT services from ICT third-party providers. Competent authorities can request the full register or specified sections.

The ITS (Implementing Regulation (EU) 2024/2956) defines standard templates and a relational structure for consistent reporting and group consolidation.

Treat the RoI as a data product: stable identifiers + relational joins + validation + export pipeline.
Use the ITS templates (B_01-B_07) as the schema contract and generate exports automatically.

Question 4

How does DORA major incident reporting work?

DORA incident reporting is a staged workflow: classification -> initial notification -> intermediate updates -> final report with root cause analysis and actual impact figures.

The RTS specify classification thresholds (Delegated Regulation (EU) 2024/1772) and the content/time limits for reporting stages (Delegated Regulation (EU) 2025/301).

Implement reporting as a pipeline: one incident data model feeding DORA reporting outputs.
Keep a classification decision log and submission receipts - that's often what's requested first.

Question 5

Do we need TLPT (threat-led penetration testing)?

Not every entity performs TLPT. The TLPT RTS (Delegated Regulation (EU) 2025/1190) specifies criteria for identifying entities required to perform TLPT.

Even if you aren't in the first wave, TLPT readiness practices improve resilience and reduce incident/reporting risk.

Build a purple-team / red-team operating model and evidence trail so you can scale to TLPT if required.
Use an external framework like ECB TIBER-EU for realistic planning and governance where applicable.

Question 6

What changed in DORA supervision after application started?

The main shift is that DORA is now operating through concrete supervisory artifacts and oversight tools, not just the core regulation text. The RoI ITS, the incident-reporting ITS, and the first critical ICT provider designations are now live reference points.

That means firms need export-ready data, template-ready reporting, and third-party governance that can answer current supervisory questions.

RoI templates: ITS 2024/2956.
Incident reporting forms and procedures: ITS 2025/302, on top of RTS 2024/1772 and 2025/301.
Critical ICT third-party provider designations: first list published by the ESAs on 18 November 2025.
Fastest practical move: tighten incident-reporting data quality and RoI exports before trying to optimize everything else.

Recommended next step

Use EU DORA FAQ as a cited research workflow

Research Copilot can take EU DORA FAQ from cited answers to recurring questions on this topic to a reusable workflow inside Sorena. Teams working on EU DORA can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Research workflow

Open Research Copilot for EU DORA FAQ

Start from EU DORA FAQ and answer scope, timing, and interpretation questions with cited outputs.

Explore next step

Talk to Sorena

Talk through EU DORA

Review your current process, evidence gaps, and next steps for EU DORA FAQ.

Explore next step

Primary sources