The EU's Digital Operational Resilience Act, Regulation 2022/2554, has applied since 17 January 2025 to financial entities and, through contracts and oversight, to their ICT providers. An engineering VP is mostly affected in four areas: incident classification and reporting, third-party risk, contract terms, and the register of information.
What does DORA cover?
ESMA summarizes six areas: ICT risk management, ICT third-party risk management, digital operational resilience testing, ICT-related incidents, information sharing, and oversight of critical third-party providers. It applies to more than twenty types of financial entity. The law sits in the regulation itself, with technical standards and delegated acts beneath it that fill in detail.
If you sell software or cloud services to a financial entity, you are the third party. Your customers must manage the risk you represent, and their contracts with you must include specified terms.
What does engineering own?
Incident readiness. Article 19 requires financial entities to report major ICT-related incidents to the competent authority. Technical standards set classification criteria and templates. Engineering has to detect, classify and describe an incident fast enough for the entity to meet its deadlines, so practice the evidence trail, not just the notification.
Third-party risk. Article 28 states that financial entities manage ICT third-party risk as part of their ICT risk framework and remain fully responsible for compliance even when services are outsourced. Customers will ask you for information, test results and subcontractor details.
Contracts. Article 30 sets key contractual provisions, including a clear description of functions and services and whether subcontracting is allowed. Expect your sales and legal teams to bring new clauses that need engineering answers.
Register of information. ESMA's page lists implementing standards on templates for the register, which entities must keep about their ICT arrangements. As a provider, you will be asked for data that fills it.
A constructed example
A bank customer asks a SaaS vendor for its subcontractor list, the regions where data is processed, and its incident notification time commitment. The vendor's engineering lead finds that the answers live in four documents and one person's memory. They build a single maintained sheet, reviewed quarterly, with owners. Next request, the answer takes an hour instead of two weeks.
What to do
- Find out whether you are a financial entity, an ICT provider to one, or both.
- Build and maintain a list of subcontractors, processing locations and services per customer.
- Define internal incident classification that maps onto customer reporting needs, and rehearse it.
- Set and test a notification commitment you can really meet.
- Review customer contract terms against Article 30 with legal, and list engineering commitments.
- Document resilience testing you perform, and be ready to share summaries.
- Track the technical standards that apply to you through ESMA and the other European supervisory authorities.
Safeguard can help with software inventories and vulnerability evidence that customers request about your components. Compliance duties remain with the regulated entity and its providers.
Quick check
Does a financial entity stay responsible if it outsources ICT services?
Yes. Article 28 says it remains fully responsible for compliance with its obligations.
When did DORA start to apply?
17 January 2025, according to the regulation text.
Sources
Last reviewed: 18 October 2026.
