When does DORA apply, and which dates should your DORA timeline use?
A regulator, client or board now expects evidence of DORA compliance. The starting point is that DORA entered into force on 16 January 2023 and has applied since 17 January 2025 (Article 64). Because it is a regulation, it applies directly in every member state without national transposition, so your timeline should work from those two dates and then add the dates that depend on your own position: your entity type, your register of information cycle, whether you rely on critical ICT third-party providers, and the pending Digital Omnibus change to incident reporting.
Start by confirming which dates bind you. Your national competent authority sets its own deadlines for submitting the register of information, and the ESAs' FAQ explains that authorities had to report registers by 30 April 2025 and must report by 31 March each year from 2026. Check the exact submission date your authority has communicated, not only the ESA cycle. If you use ICT services from providers on the first list of designated critical ICT third-party service providers, published by the ESAs on 18 November 2025, confirm with those providers how their oversight affects your contracts. Also track the Digital Omnibus proposal COM(2025) 837 through the Legislative Observatory procedure page), which as of October 2026 was awaiting committee decision, and plan for either outcome in your incident reporting process.
Responsibilities are separate. Your organization owns its controls and decides its timeline. An implementation partner such as DeployOpen can prepare systems, configurations and evidence against the dates you adopt, but no auditor or certification body can certify DORA compliance, and no partner can issue an attestation on your behalf. Competent authorities supervise compliance using their Article 50 powers, and the Commission review due by 17 January 2028 may change the rules that your timeline must track. Record each date, its source and the named owner in your programme plan, and review it whenever your authority or the EU publishes a change.
Key DORA dates in sequence, from publication to the 2028 review
This sequence shows which DORA dates a programme must work from, so each date is matched to the document, register or evidence it requires before the next milestone arrives.
Confirm publication in the Official Journal
Regulation (EU) 2022/2554 was published in the Official Journal (OJ L 333) on 27 December 2022. Legal and compliance teams should pull the consolidated text from EUR-Lex and record the publication reference in the programme charter, so every later obligation traces back to a fixed legal source. The step is complete when the team holds the official text and has noted the article numbering it will work from.
Track entry into force on 16 January 2023
DORA entered into force on the twentieth day after publication, which is 16 January 2023. Entry into force did not itself impose operational duties, but it started the period in which the European Supervisory Authorities and the Commission produced the technical standards. Governance owners should log this date and map which standards were still in draft at that point, so they can see which requirements were not yet final.
Meet application from 17 January 2025
DORA has applied since 17 January 2025 under Article 64, and it is directly applicable in every member state without national transposition. Directive (EU) 2022/2556 applies its measures from the same date. By this date the management body should have approved an ICT risk management framework, incident management processes and a third-party risk policy, and the entity should be able to show supervisors that they are operating. The check is a signed set of policies with approval dates on or before this day.
Adopt the technical standards as they were published
The Commission adopted the technical standards in stages. Delegated Regulation (EU) 2024/1774 was published in the Official Journal on 25 June 2024 and covers ICT risk management tools and the simplified framework. Implementing Regulation (EU) 2024/2956 was published on 2 December 2024 and sets the register of information templates. Delegated Regulation (EU) 2025/301 was published on 20 February 2025, Delegated Regulation (EU) 2025/1190 on 18 June 2025, and Delegated Regulation (EU) 2025/532 on 2 July 2025. Each published standard should be mapped to the policies and controls it changes, with a version history kept in the compliance repository.
Report the register of information on the ESA cycle
Under ESA Decision 2024 22, competent authorities had to report registers to the ESAs by 30 April 2025, and from 2026 onwards by 31 March of each calendar year. Competent authorities may set earlier deadlines for financial entities, so the first task is to confirm the local submission date with the supervisor. Each year the entity should refresh the register against its live contract inventory and submit it through the channel its authority specifies. The step is done when the authority confirms receipt.
Confirm the first critical provider list
The ESAs published the first list of designated critical ICT third-party service providers on 18 November 2025, naming 19 providers. Financial entities should check whether any of their ICT suppliers appears on the list, then review concentration risk, exit plans and contract clauses for those providers. Teams should also confirm which of their providers are not designated, because those remain under their own contractual oversight. The check is a documented mapping of each critical supplier to the affected services.
Prepare for the Commission review by 17 January 2028
Article 58(1) requires the Commission to review DORA and report to the European Parliament and the Council by 17 January 2028. The review covers, among other things, the criteria for designating critical ICT third-party providers and the voluntary nature of significant cyber threat notification. Meanwhile, the Commission's Digital Omnibus proposal COM(2025) 837 would move major incident reports and voluntary threat notifications through a single NIS2 entry point, and procedure 2025/0360(COD) was still awaiting committee decision as of October 2026. Programme owners should keep their incident reporting procedures flexible and confirm the current procedure status with their authority.
When each technical standard was published and what it changes
DORA's technical standards arrived in stages after the Regulation began to apply on 17 January 2025. Each one details a specific article, so the publication date tells a programme when the detailed rule became available to plan against. Confirm the current consolidated text on EUR-Lex before relying on any of them.
Delegated Regulation 2024/1774 on ICT risk tools
This delegated regulation was adopted on 13 March 2024 and published in the Official Journal on 25 June 2024. It supplements Article 15 on ICT risk management tools, methods, processes and policies, and Article 16(3) on the simplified framework. Entities should check which detailed security requirements apply to them and whether the simplified regime is available, because these set the baseline for the ICT risk management framework.
Implementing Regulation 2024/2956 on register templates
This implementing regulation was adopted on 29 November 2024 and published on 2 December 2024. It implements Article 28(9) by setting standard templates for the register of information on contractual arrangements with ICT third-party providers. Teams building the register should confirm the current template set and field rules against the EUR-Lex text before loading data.
Delegated Regulation 2025/301 on incident classification
Adopted on 23 October 2024 and published on 20 February 2025, this delegated regulation supplements the first paragraph, point (a), of Article 20. It governs how ICT-related incidents and cyber threats are classified, including the criteria that determine whether an incident is major. Incident response runbooks and reporting thresholds should be checked against it, since classification drives which reporting deadlines apply.
Delegated Regulation 2025/532 on subcontracting
Adopted on 24 March 2025 and published on 2 July 2025, this delegated regulation supplements Article 30(5) on subcontracting ICT services that support critical or important functions. It affects contract terms and due diligence for providers that pass work to their own subcontractors. Procurement and legal teams should update subcontracting clauses and the register to reflect its conditions.
Delegated Regulation 2025/1190 on threat-led testing
Adopted on 13 February 2025 and published on 18 June 2025, this delegated regulation supplements Article 26(11) and sets the detailed rules for threat-led penetration testing. Entities selected for TLPT should confirm its phases, deadlines and tester requirements against the EUR-Lex text, and check how it interacts with any TIBER-EU framework their authority applies.
How the register of information deadlines work for each party
Financial entities keep the register of information and send it to their competent authority. They do not report directly to the ESAs. The ESAs' decision ESA 2024 22 of 8 November 2024 sets the reporting cycle for competent authorities, and competent authorities may set earlier deadlines for the entities they supervise. The first step for an entity is therefore to find out what its own authority requires, not to work from the European-level dates alone.
- Local deadlines: Ask your competent authority for its submission window, format and portal, because it may set a date earlier than the European cycle.
- Maintenance between submissions: Keep the register current throughout the year so that the annual extract reflects contracts as they stand, not as they stood at the last deadline.
- Templates and identifiers: Use the templates in Implementing Regulation (EU) 2024/2956 and the identifier rules that your authority expects.
- Ownership: Name the person accountable for the submission and confirm who signs off on the data.
- Contract changes: Record new ICT arrangements and terminations as they happen, so the register does not lag behind procurement.
Confirm your authority's date and format before planning the work, since these are the deadlines that bind your organization.
Competent authorities receive registers from the financial entities they supervise, check them and pass consolidated information to the ESAs. Under ESA 2024 22 of 8 November 2024, as explained in the ESAs' FAQ, they had to report registers to the ESAs by 30 April 2025. From 2026 onwards, the deadline is 31 March of each calendar year. The authority's own collection timetable sits before that date, so entities should expect internal cut-offs earlier than the European deadline.
- First submission: Competent authorities reported registers to the ESAs by 30 April 2025.
- Annual cycle: From 2026 onwards, the ESA deadline is 31 March of each calendar year.
- Entity deadlines: Authorities may set earlier deadlines for financial entities, so each authority publishes its own timetable.
- Quality checks: Authorities review identifiers and data completeness before forwarding, so gaps can come back as queries.
- Supervisory use: The register also informs supervision of ICT third-party risk, so inconsistencies can attract attention beyond the submission itself.
For the exact cycle and any national variations, confirm with your authority and read the ESAs FAQ of 28 March 2025 for reporting details.
The European Supervisory Authorities (EBA, EIOPA and ESMA) receive registers from competent authorities and use them for oversight of ICT third-party risk, including the designation of critical ICT third-party service providers. The ESAs do not receive registers directly from most financial entities. Their role is to set the reporting framework and publish guidance that competent authorities and entities rely on when preparing submissions.
- Framework decision: ESA 2024 22 of 8 November 2024 sets the reporting arrangements that competent authorities follow.
- Guidance: The ESAs' FAQ on reporting of registers, dated 28 March 2025, answers practical questions on submissions.
- Q&A process: Targeted questions are answered through the EBA's single rulebook Q&A, which may clarify specific edge cases.
- Downstream use: Register data supports the ESAs' oversight work, including the list of designated critical providers published on 18 November 2025.
- Updates: Guidance can change, so check the ESAs' publications for the latest version before each cycle.
Read the ESAs FAQ of 28 March 2025 and the EBA Q&A process for the detailed reporting rules that apply to your submission.
What the first critical provider list on 18 November 2025 means for your contracts
On 18 November 2025 the European Supervisory Authorities published the first list of designated critical ICT third-party service providers, naming 19 providers. Designation moves oversight of those providers to the ESAs, which act as Lead Overseers under Articles 31 to 44 of DORA. The provider remains responsible for its own services, but its oversight now runs through the EU level rather than only through the competent authorities of each financial entity. For you, the list does not remove any obligation. Your Article 28 duties for every ICT provider, listed or not, still apply in full.
Start by checking your register of information against the list. Confirm whether each provider supporting a critical or important function is on it, and record the identifier and contract details that the register requires. Then review concentration risk. If several critical functions depend on one designated provider, that dependency should appear in your third-party risk assessment, and the exit plan for it should be tested rather than assumed. Do not treat designation as a reason to relax your own due diligence or contract clauses. Designation tells you the provider is under heavier oversight; it does not tell you it meets your requirements.
For providers not on the list, the same discipline applies. Keep their register entries accurate, document why each one was or was not assessed as critical or important, and keep the record current. Check the list directly at the source before you rely on it, because the designated population can change, and any future designation is for the ESAs to decide and publish. The ESAs' list is available as a PDF from the ESAs' list of designated critical ICT third-party providers. Record the date you checked it in your third-party file.
What is still moving: the 2028 review and the Digital Omnibus proposal
Two open items could change how DORA programmes are scoped and how incidents are reported. The Commission's 2028 review may revisit provider designation and voluntary threat notification, while the Digital Omnibus proposal would change where major incident reports are sent. Plan around both as pending until they are adopted.
The 2028 Commission review
Article 58(1) requires the Commission to review DORA and report to the European Parliament and the Council by 17 January 2028. The review covers, among other things, the criteria for designating critical ICT third-party providers, which determine which providers the ESAs oversee directly. Financial entities should follow the report because it may change designation criteria that affect their provider lists. Until it is published, keep registers and provider due diligence aligned with the rules in force. Regulation text
Voluntary significant threat notification
The same review must also examine the voluntary nature of significant cyber threat notification. Today, notifying a competent authority about a significant cyber threat is voluntary, so entities decide whether to report a threat that has not yet caused an incident. A change to that status would turn a choice into an obligation. Ask your legal and security teams to document how the threat intelligence process currently decides what gets reported, so the process can be revisited quickly if the rule changes.
Digital Omnibus single entry point
The Commission's Digital Omnibus proposal COM(2025) 837, dated 19 November 2025, would amend DORA Article 19. Under it, major incident reports and voluntary threat notifications would pass through a single entry point under NIS2. For entities regulated under both regimes, this could simplify routing, but it would also change the channel that incident runbooks, templates and contacts name today. Treat the reporting channel as a configurable item in incident procedures, not a fixed detail.
Pending, not yet law
As of October 2026, the European Parliament's Legislative Observatory lists procedure 2025/0360(COD) as awaiting committee decision. Until that procedure concludes and any amended text is published, DORA Article 19 applies as written. Treat the proposal as a scenario to plan for, check the procedure status at each governance review, and avoid contracts or tooling that assume the single entry point already exists. Procedure status)
How to build a DORA plan around these dates
A compliance lead turns the DORA timeline into a work plan by starting from the nearest fixed date and working backwards. The first such date is the next register of information submission. Competent authorities report registers to the ESAs by 31 March each calendar year from 2026 onwards, but each authority sets its own earlier deadline for financial entities, so the first task is to confirm that deadline with your supervisor and place it at the top of the plan. Count back from it to the data collection, identifier checks and sign-off steps that must finish beforehand. The register is a recurring annual cycle, so the same backward schedule should be repeated each year and not treated as a one-off project.
Next, map each technical standard to the internal controls and documents it touches. Delegated Regulation (EU) 2024/1774 on ICT risk management tools and simplified frameworks, Delegated Regulation (EU) 2025/532 on subcontracting, and Delegated Regulation (EU) 2025/1190 on threat-led penetration testing each change a different part of the programme. Assign an owner to each row, note which policies, contracts and test results it affects, and flag any item that depends on a provider's cooperation. Set review points at the 17 January 2028 Commission review, which covers the criteria for designating critical providers and the voluntary nature of significant threat notification, and at the decision on procedure 2025/0360(COD), the Digital Omnibus, which would change how Article 19 incident reports are routed. Both dates may change the plan, so review them at fixed intervals and record what would trigger a change.
The organization owns the timeline, the risk decisions and the sign-off of every policy, register and report. An implementation partner can prepare documents, registers and evidence inside a written scope that states the deliverables, the dates and who reviews them. Ask the partner to show which steps it will complete before each internal deadline and which steps need your staff or your providers. Confirm the authority deadlines directly with your competent authority, as the ESAs' guidance leaves these to national supervisors.
DORA timeline questions buyers ask
Did DORA apply before January 2025?
No. DORA has applied since 17 January 2025 under Article 64. It entered into force on 16 January 2023, the twentieth day after its publication in the Official Journal on 27 December 2022, so the period between those dates was a preparation window with no general compliance duty. Member states had to apply the measures in Directive (EU) 2022/2556 from the same date, 17 January 2025. Any internal target dates you set before that point were planning choices, not legal deadlines. Your competent authority can confirm whether it expects evidence of progress against the 2025 start date, and you should check the full text of the Regulation for the article references your gap analysis will cite.
Does each EU country need its own DORA law?
No. DORA is a regulation, so it is directly applicable in all member states without national transposition. Its obligations apply on the same date across the Union. National law still matters in two places. The first is Directive (EU) 2022/2556, which amends eight sectoral directives, including the Capital Requirements Directive, MiFID II and PSD2, and which member states had to apply by the same date. The second is the designation of competent authorities and the penalty regime, which member states must set up under Chapter VII. Check your national supervisor's guidance for how it applies these rules to your entity type, because the supervisory practice and reporting channels can differ between countries even though the Regulation is the same.
Which date should the register of information plan follow?
Plan around the date your competent authority gives you, because the ESAs' framework allows authorities to set earlier deadlines. The fixed points are these. Under ESA Decision 2024 22 of 8 November 2024, competent authorities had to report registers to the ESAs by 30 April 2025. From 2026 onward, they report by 31 March of each calendar year. Your register therefore needs to be complete, validated and approved in time for your authority's internal cut-off, which usually falls before the ESA deadline. Work backward from that cut-off through data collection from ICT providers, identifier checks and management sign-off. The ESAs' FAQ on register reporting.pdf) explains the reporting cycle. Confirm the exact annual submission window with your authority.
When were the DORA technical standards published?
The technical standards were published in stages between mid-2024 and mid-2025, so some were not available when DORA first applied. Commission Delegated Regulation (EU) 2024/1774 on ICT risk management tools, methods, processes and policies was published on 25 June 2024. Implementing Regulation (EU) 2024/2956 on standard templates for the register of information was published on 2 December 2024. Delegated Regulation (EU) 2025/301, on incident classification under Article 20, was published on 20 February 2025. Delegated Regulation (EU) 2025/1190 on threat-led penetration testing was published on 18 June 2025. Delegated Regulation (EU) 2025/532 on subcontracting of ICT services supporting critical or important functions was published on 2 July 2025. Build your gap analysis against the versions in force on the day you assess, and confirm with your authority which version it uses as the reference point.
Is the Digital Omnibus change already law?
No. The Commission proposed the Digital Omnibus in COM(2025) 837 on 19 November 2025. It would amend DORA Article 19 so that major incident reports and voluntary threat notifications go through a single entry point under NIS2. As of October 2026, the European Parliament's Legislative Observatory lists the procedure, 2025/0360(COD), as awaiting committee decision. A proposal is not binding, so your reporting process must follow the current text of Article 19 until the amendment is adopted and published. Do not design a single-channel workflow on the assumption that it will pass in its proposed form. Track the procedure page) and ask your authority how it will handle the transition if the change is adopted.
What could the 2028 DORA review change?
Article 58(1) requires the Commission to review DORA and report to the European Parliament and the Council by 17 January 2028. The review covers, among other things, the criteria for designating critical ICT third-party providers and the voluntary nature of significant cyber threat notification. Those two topics matter most for planning. If the designation criteria change, the set of providers overseen by the ESAs could change, which would affect the concentration and exit assumptions in your ICT third-party risk work. If the voluntary notification element changes, your threat reporting procedures and the information you share could change too. The review does not automatically amend the Regulation, and any change would need its own legislative process. Build your programme to be modular, so that contract clauses, the register and incident procedures can each be updated without a full rewrite.
When did the ESAs publish the first critical provider list?
The ESAs published the first list of designated critical ICT third-party service providers on 18 November 2025, naming 19 providers. If one of your ICT suppliers appears on the list, the designation changes how it is overseen, but it does not remove your own duties. You still hold the contractual, due diligence, register and exit plan obligations for every ICT service you use. Check the list against your register of information, including indirect dependencies through subcontractors, because the list shows the designated providers, not every provider your entity relies on. Confirm with your competent authority how it expects you to record a designated provider in your third-party risk file. The official list is available from the ESAs' publication.
How much internal effort do the DORA dates imply?
The dates imply a continuous workload rather than a single project. Each annual register cycle, each review of the ICT risk framework, each test programme and each contract renewal recurs. The internal effort depends on how many ICT services you use, how many of them support critical or important functions, how many subcontractors sit behind them, and how mature your current documentation is. Build the plan backward from the fixed points: the application date, the technical standards you must follow, the 31 March register cycle and the 2028 review. Assign owners for register data, contract clauses, incident procedures and testing, and agree which tasks you will do internally and which you will outsource. When you request a quote from an implementation partner, ask for the work to be defined in writing against those recurring activities, so you can compare offers on the same scope.
What to check before a DORA deadline arrives
DORA has applied since 17 January 2025, so most dates that matter now are supervisory deadlines and review points rather than go-live dates. The cards below set out five checks that connect the timeline to your own obligations, from confirming scope to assigning owners for the 2028 review and the pending Omnibus decision.
Confirm entity type and scope
Start by matching your organization to one of the 20 types of financial entity listed in Article 2(1), and note whether any member state exclusion or the microenterprise regime applies to you. Scope decides which obligations apply and when they bite, so record the reasoning in writing. Ask legal counsel to confirm the classification if you sit near a boundary, such as a payment institution that also provides crypto-asset services.
Identify your competent authority
Find the national competent authority that supervises your entity type under Article 46, and check whether the ECB supervises you as a significant credit institution. That authority sets your register submission deadline and any earlier internal dates, so confirm them in writing rather than relying on the ESA cycle alone. Note who in your team receives its notices.
Map the technical standards to your controls
Check which delegated and implementing regulations apply to each area you run, such as ICT risk management tools under Delegated Regulation (EU) 2024/1774 or subcontracting under 2025/532. Build a control register that cites each standard by number, so an assessor can trace a requirement to a named control. Recheck the list when the Commission adopts further technical standards.
Inventory ICT providers against the critical list
List every ICT third-party service provider and mark which support critical or important functions. Compare the list with the first designation of critical providers published on 18 November 2025, which named 19 providers. Where a provider is on that list, confirm how oversight affects your contract and exit planning. Where it is not, confirm that your contract clauses and register entries still meet Article 30.
Assign owners for 2028 and Omnibus
Name one accountable owner for the Commission review due by 17 January 2028, which will cover the criteria for designating critical providers and the voluntary nature of significant threat notification. Name a second owner to track procedure 2025/0360(COD), which would route major incident reports through a single NIS2 entry point if adopted. Give each owner a review date and a route to the management body.
Why DORA programmes slip against these dates
The most common slip is planning from the entry into force date. DORA entered into force on 16 January 2023, but the obligations became enforceable on 17 January 2025 under Article 64. Teams that treated 2023 as the starting point spent the intervening period on general awareness and then discovered that their ICT risk framework, incident process and third-party contracts were not in place when supervisors began to ask for them. The practical check is to date every workstream from the application date, then work backwards to the evidence each supervisor will request, not forward from the date the Regulation was published.
A second source of delay is treating the Digital Omnibus proposal as settled. COM(2025) 837 would change how major incident reports and voluntary threat notifications are routed under Article 19, but the procedure (2025/0360(COD)) is still awaiting committee decision. Incident reporting processes built around a single entry point that has not been adopted will need rework if the final text differs. Ask your competent authority how it intends to handle the transition, and keep your current reporting channels documented until the change is final. The Legislative Observatory procedure page) is the place to confirm the current status.
Programmes also slip when they rely on an outdated version of a technical standard. The delegated and implementing regulations that detail DORA were published at different points, including 2024/1774 in June 2024 and 2025/1190 in June 2025, and each one has its own application logic. Gap analyses and policies written against an early draft or a summary can miss requirements added later. Assign an owner to maintain a dated list of the standards in force, confirm each one against the Official Journal text, and record which version each policy was checked against. Finally, leaving the register of information until the final month is a planning error. The ESAs' reporting cycle requires registers to be submitted each year by 31 March from 2026, and your competent authority may set an earlier internal date. Confirm that date now, and build the register in advance so that data quality checks have time to run.
