DORA Article 16 provides a simplified ICT risk management framework for specific small entities, such as small and non-interconnected investment firms and certain exempted payment, e-money and pension institutions. They skip Articles 5 to 15 but must still keep a documented framework, monitor systems, manage incidents, test continuity and identify key third-party dependencies.
Who is covered
Article 16(1) lists: small and non-interconnected investment firms, payment institutions exempted under Directive (EU) 2015/2366, certain institutions exempted under Directive 2013/36/EU where member states opted out of DORA coverage, electronic money institutions exempted under Directive 2009/110/EC, and small institutions for occupational retirement provision.
The text says "small and non-interconnected" for investment firms. Check the national and sector definitions with your regulator. Do not assume you qualify by headcount alone.
What they still must do
Article 16(1) second subparagraph requires these entities to:
- Maintain a sound, documented ICT risk management framework describing mechanisms and measures for quick and comprehensive ICT risk management, including physical components.
- Continuously monitor the security and functioning of all ICT systems.
- Minimise ICT risk impact with sound, resilient, updated systems, protocols and tools, protecting availability, authenticity, integrity and confidentiality of data.
- Allow ICT risk sources and anomalies to be promptly detected and incidents swiftly handled.
- Identify key dependencies on ICT third-party providers.
- Ensure continuity of critical or important functions through business continuity plans and response and recovery measures, including backups and restoration.
- Test these plans and measures regularly, and test the controls from points 1 and 3.
- Apply operational conclusions from tests and post-incident analysis in the risk assessment, and run awareness and resilience training according to need and risk profile.
The framework must be documented and reviewed periodically and after major incidents, and a review report goes to the competent authority on request.
Everyone else: proportionality
Article 4 applies to all entities. Chapter II rules are applied in line with size, overall risk profile, and the nature, scale and complexity of services and operations. Microenterprises get specific lighter treatment in several articles, for example reviews of the framework "periodically" rather than yearly, no mandatory independent control function, and risk based balancing of testing resources. Proportionality scales the effort. It does not remove the duty.
Practical approach for a small team
- Write a short framework document that maps each of the eight points to a named owner and a real artifact.
- Keep a list of ICT providers and mark which support critical functions.
- Test restore from backup and write down the result.
- Record incidents, even small ones, and what you changed afterwards.
- Check how your regulator wants incidents reported. Article 19 reporting applies to major incidents.
Small teams usually lack time to build tooling. Safeguard's SBOM and dependency scanning, compliance and evidence automation and policy features can reduce manual work for the technical evidence.
Quick check
Does the simplified framework cancel incident reporting?
Article 16 sets aside Articles 5 to 15 for the listed entities. Incident handling and reporting duties remain under the framework and Chapter III, so confirm with your authority.
Who decides if I qualify as small and non-interconnected?
The definitions come from DORA and the related sector laws, applied by your competent authority. Ask them if the position is unclear.
Sources
Last reviewed: 19 October 2026.
