DORA Is Now Applicable: What Actually Changed on January 17, 2025
Unlike NIS2, DORA needed no national transposition — it became binding across the entire EU financial sector on a single day. Here's what that actually triggers.
October 21, 2026
v1
2 min
DORA Is Now Applicable: What Actually Changed on January 17, 2025
Regulation (EU) 2022/2554 — the Digital Operational Resilience Act — became directly applicable across every EU member state on 17 January 2025. As a regulation rather than a directive, DORA needed no transposition step, so the applicability date is genuinely uniform.
The obligations that actually started on day one
- ICT risk-management frameworks had to be documented and approved at the management-body level.
- Incident classification and reporting processes had to be operational, not just planned.
- Contracts with ICT third-party providers had to include DORA's required contractual provisions — exit strategies among them.
Related Executive Guides
A practitioner's guide to the Digital Operational Resilience Act — the five pillars, incident reporting, resilience testing, and what it means for both financial entities and their ICT vendors.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.