Regulatory Update · 2 min read
DORA Is Now Applicable: What Actually Changed on January 17, 2025
Unlike NIS2, DORA needed no national transposition — it became binding across the entire EU financial sector on a single day. Here's what that actually triggers.
Regulation (EU) 2022/2554 — the Digital Operational Resilience Act — became directly applicable across every EU member state on 17 January 2025. As a regulation rather than a directive, DORA needed no transposition step, so the applicability date is genuinely uniform.
The obligations that actually started on day one
- ICT risk-management frameworks had to be documented and approved at the management-body level.
- Incident classification and reporting processes had to be operational, not just planned.
- Contracts with ICT third-party providers had to include DORA's required contractual provisions — exit strategies among them.
What's still rolling out
The European Supervisory Authorities' framework for designating "critical" ICT third-party providers — the piece of DORA that can bring a cloud provider under direct regulatory oversight — is being operationalized over 2025, not something every provider needs to react to on day one.