NIS2 vs DORA: which applies to you and how they overlap

NIS2 is a directive that sets cybersecurity duties across many sectors and is transposed into national law. DORA is a regulation that applies directly to financial entities and their ICT providers. A financial firm usually follows DORA for the overlap, while a software vendor may meet both through its customers.

What kind of legal act is each?

NIS2 is Directive (EU) 2022/2555. Member States had to transpose it by 17 October 2024, so the exact duties come from national law. DORA is Regulation (EU) 2022/2554. ESMA states it entered into force on 16 January 2023 and applies as of 17 January 2025, and it covers more than 20 types of financial entity. A regulation has direct effect, so there is one text, with technical standards supplementing it.

Who falls under which?

NIS2 covers 18 critical sectors, including energy, transport, healthcare, finance, water, digital infrastructure and public administration, and applies as a rule to medium and large entities. DORA covers financial entities and sets an oversight framework for ICT third party providers designated as critical by the European supervisory authorities.

For a bank, both could seem to apply. The NIS2 text deals with that in its recitals: sector specific Union acts with cybersecurity risk measures or reporting obligations at least equivalent in effect can lead competent authorities under those acts to supervise those duties, with help from NIS2 authorities. Read this as a coordination rule and confirm the specifics with national supervisors and counsel.

How do the contents compare?

ESMA lists DORA's pillars: ICT risk management, ICT third party risk management with key contractual provisions, digital operational resilience testing including advanced testing, management and reporting of ICT related incidents, information sharing, and oversight of critical third party providers. NIS2 Article 21 lists measures including risk analysis policies, incident handling, business continuity, supply chain security, secure development and vulnerability handling, and effectiveness assessment. Article 23 sets 24 hour early warning, 72 hour notification and one month final report for significant incidents.

Overlap is strong on risk management, incident handling, supplier risk and testing. The difference is detail. DORA goes further on contract terms with ICT providers, resilience testing and a register of information about those arrangements, backed by technical standards.

Constructed example: an insurer outsources claims processing to a SaaS vendor. The insurer, as a financial entity, needs DORA compliant contract terms and register entries for that vendor. The vendor itself, if it is a medium sized digital service provider in a NIS2 sector, may have its own national duties. The same incident can create obligations on both sides, with different recipients and forms.

What does this mean for a vendor?

If you sell to financial customers, expect DORA derived contract requests: audit and access rights, subcontracting disclosure, incident cooperation, exit support. If you sell into NIS2 sectors, expect supply chain security questionnaires. Build one set of evidence and commitments that answers both, then adapt wording per customer.

How to check or apply this

1. Decide if you are a financial entity, an ICT provider to one, a NIS2 entity, or several of these.
2. For each country, find the national NIS2 law and the competent authority.
3. For financial customers, collect the DORA contract clauses they ask for and standardize your answer.
4. Make one incident process that can produce a 24 hour early warning for customers, and then separate forms per regulator.
5. Keep a subcontractor list ready for register and supply chain questions.
6. Recheck sources each quarter, since technical standards and national laws are still evolving.

Quick check

Sources

• Directive (EU) 2022/2555 (NIS2), EUR-Lex
• European Commission: NIS2 Directive
• ESMA: Digital Operational Resilience Act

Last reviewed: 18 October 2026.