DORA cost and timeline depend on how many ICT systems and third-party providers you have, how mature your existing risk management is, and how much of your evidence is already organized. We give no price figures because the sources we checked had none you can rely on. DORA has applied since 17 January 2025.
This is not legal advice. Whether and how DORA applies to you depends on your entity type and your supervisor's expectations.
What does the Regulation require at a high level?
Article 64 of Regulation (EU) 2022/2554 says it applies from 17 January 2025. The Regulation sets out an ICT risk management framework in Article 6, asset inventories in Article 8, and rules on ICT third-party risk in Article 28, including a register of information on all contractual arrangements for ICT services from third parties. Article 30 lists contract elements, with more for services supporting critical or important functions.
The Regulation's recitals also refer to regular testing of ICT systems and to business continuity and recovery plans. Each of those streams of work has a cost.
What drives cost?
Number of ICT providers. The register of information covers all contractual arrangements for ICT services. A firm with hundreds of vendors has far more data to collect than one with thirty. Confirm the current register format with your supervisor, since data quality is usually the larger effort.
Contract remediation. Contracts for critical or important functions need specific terms. Renegotiation takes legal time and sometimes vendor pushback.
Asset inventory quality. If your application and asset inventory is incomplete, building it comes first.
Testing program. Regular testing of ICT systems, and advanced testing for some entities, adds engineering and assurance costs. What applies depends on entity category.
Incident handling. Classification, internal escalation and reporting need processes and exercises.
Group structure. The Regulation refers to registers at entity, sub-consolidated and consolidated levels, so groups with many entities carry more coordination work.
Tooling and services. Whether you buy a platform, rely on spreadsheets, or add consultants depends on your volume and team.
What drives timeline?
The longest items are those that need other organizations: vendor data, contract changes and joint testing. Internal items such as inventories, policies and training move faster if an owner is named. Supervisory feedback can reopen items, so leave room for it.
A sensible order is to start with the inventory and register, since many other duties draw on them, then address contracts for the most critical vendors, then testing and incident processes.
What is easy to underestimate?
Two items surprise teams. First, data collection from vendors: each record in the register needs facts only the vendor holds, and replies arrive slowly. Second, ownership: someone has to keep the register current as contracts change, which is a standing job and not a project. Budget for both, and treat the first filing as the start of a routine.
How does software supply chain visibility help?
A current inventory of software components and vendors shortens the register and inventory work. Dated vulnerability findings and fix records show monitoring in action. Safeguard's compliance automation can help organize that evidence. It does not make you DORA compliant.
What to do
- Confirm with counsel whether DORA applies to each entity and in what form.
- Count your ICT vendors and rank them by criticality.
- Fill the register for the top tier first, with owners per record.
- List contracts needing amendment and start with critical services.
- Review inventories of applications and assets for gaps.
- Set a budget range only after those counts, and review it with finance quarterly.
Quick check
Is there a standard DORA price?
No. Cost varies with vendor count, entity type and your starting point.
What should come first?
Usually the inventory and register of information, because other duties depend on them.
Sources
Last reviewed: 18 October 2026.
