The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to EU financial entities and, through them, to their ICT service providers. If you build software for banks, insurers or investment firms, your product decisions affect incident reporting, contract terms and how easily a customer can show regulators its dependencies.
Who is covered?
EIOPA states that DORA applies to 20 types of financial entity as well as ICT third-party service providers. The regulation is Regulation (EU) 2022/2554. It aims to ensure firms can withstand, respond to and recover from ICT disruptions such as cyberattacks and system failures.
If you are a supplier, you are usually reached by contract rather than direct supervision, unless a competent authority designates you as critical. Your customers will push DORA requirements into your agreements.
What will customers ask a product team for?
The regulation's text points to several obligations that translate into product requests.
A register of information. Financial entities must keep a register of all contractual arrangements for ICT services from third-party providers, and supervisors can request it. Expect customers to ask for structured information about your service, subcontractors and where data is processed.
Incident reporting. Article 19 requires financial entities to report major ICT-related incidents to the competent authority. A customer cannot report what you do not tell them, so expect demands for fast, clear incident notices, with cause and impact data.
Resilience testing. The text provides for advanced testing based on threat-led penetration testing for entities that meet specified criteria. Suppliers may be asked to take part or to share results relevant to the customer's testing.
Risk framework review. The ICT risk management framework must be documented and reviewed at least once a year, so customers will ask for current evidence from you, not a three-year-old report.
What does this look like in a constructed case?
A payments analytics vendor gets an addendum from a bank customer. It asks for a list of subprocessors, an incident notification window, exit and data return support, and audit rights. The product manager's contribution: ship an exportable subprocessor list, build an incident status feed customers can subscribe to, and document how a customer can retrieve its data and leave.
Those are product features that shorten every future negotiation.
What should you not promise?
Be careful with contract commitments you cannot operationalize. A customer may ask for notice of any incident within hours. Before agreeing, check that your monitoring can detect incidents that fast, that someone can classify impact and that a template exists. A missed promise in a regulated customer's contract is worse than a longer, honest window.
Likewise, do not describe your product as "DORA compliant". The regulation obliges financial entities, and suppliers support them. Say what you provide: subprocessor lists, incident notices, exit support, audit cooperation. Counsel should approve the wording, and the claims should match what customers can verify.
How to check or apply this
- Ask sales which customers are EU financial entities and collect their DORA addenda.
- Build a single answer set: subprocessors, hosting locations, incident process, exit plan.
- Define your incident notice content and timing, and test it in a drill.
- Make audit and evidence requests self-service where possible.
- Review contract language on termination, data return and subcontracting.
- Get counsel to confirm which obligations reach you directly.
Safeguard's software inventory and SBOM capabilities can help you answer dependency and subcontractor questions with data. Legal applicability is a matter for counsel.
Quick check
Does DORA apply to a US software vendor?
Often indirectly. If you serve EU financial entities, they must manage you as an ICT third-party provider, and your contract will reflect that.
When did DORA start applying?
On 17 January 2025, according to EIOPA.
Sources
Last reviewed: 18 October 2026.
