DORA (Regulation 2022/2554) is the sector-specific rule for financial entities and applies since 17 January 2025, while NIS2 (Directive 2022/2555) covers many other sectors. A bank follows DORA. A software vendor to banks is usually not a financial entity, but DORA contract rules reach it, and NIS2 may apply on its own terms.
How the two laws relate
DORA Article 1(2) says that for financial entities identified as essential or important under national NIS2 rules, DORA is "a sector-specific Union legal act" for the purposes of NIS2 Article 4. A DORA recital goes further and says DORA is lex specialis with regard to NIS2. In plain terms, financial entities follow DORA's more detailed rules in the areas it covers.
NIS2 Article 2(10) also says the directive does not apply to entities that member states exempted from DORA under DORA Article 2(4).
NIS2 Article 33(6) asks authorities under NIS2 to cooperate with DORA authorities, and to inform the DORA Oversight Forum when acting against an important entity that is a designated critical ICT third-party provider.
Three common situations
1. You are a financial entity. The list in DORA Article 2(1) includes credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and insurance intermediaries, and others. DORA applies.
2. You sell software or services to financial entities. DORA Article 2(1)(u) lists "ICT third-party service providers" within the scope of the regulation. In practice the main effect is through contracts: the financial entity must include the terms in DORA Article 30 and manage you under its ICT third-party risk framework. If you are designated critical, you face direct oversight.
3. You are in a NIS2 sector yourself. If you are, for example, a cloud, data centre or managed service provider of medium size or larger, NIS2 may apply to you directly under national law, whether or not you also serve banks.
A company can be in situations 2 and 3 at once.
Where the two differ in practice
- Incident reporting: NIS2 uses 24 hours, 72 hours and one month. DORA uses initial, intermediate and final reports, with timings set in a Commission regulation: initial notice within four hours of classifying an incident as major and no later than 24 hours from awareness.
- Testing: DORA has a detailed testing chapter, including threat-led penetration testing for selected entities.
- Third parties: DORA has a register of information, mandatory contract terms, exit strategies and EU level oversight of critical providers.
A decision path
- List your entity types against DORA Article 2 and NIS2 Annexes I and II.
- Identify which of your customers are financial entities.
- Check your national NIS2 transposition for scope and registration.
- Prepare a standard DORA contract addendum response.
- Keep one incident process that can feed both reporting formats.
Safeguard's compliance and evidence automation and SBOM and dependency scanning can supply technical evidence that customers and supervisors ask for. Which law applies is a legal question, so take advice for your case.
Quick check
Can a company be subject to both laws?
Yes, for different activities. A financial entity follows DORA as the sector rule. A vendor may be in NIS2 scope itself while also being an ICT third-party provider to DORA entities.
Does DORA apply in the UK or US?
DORA is an EU regulation. It reaches non-EU providers mainly through the contracts and oversight of EU financial entities that use them.
Sources
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Delegated Regulation (EU) 2025/301, EUR-Lex
Last reviewed: 19 October 2026.
