Skip to content
AI Policy Generator

ESWhat applies

European Union · Regulation

Digital Operational Resilience Act (DORA)

In forceDORA

Summary

It requires banks, insurers and other financial entities to manage technology risk. Any AI model or service bought from a third party is an ICT service and must appear in the vendor register, with a contract, risk analysis and exit plan.

Who it applies to

EU financial entities and insurers, and their critical ICT providers.

Penalties

Set by each Member State; include fines and supervisory measures.

Official name
Reglamento (UE) 2022/2554 del Parlamento Europeo y del Consejo, de 14 de diciembre de 2022, sobre la resiliencia operativa digital del sector financiero
Official reference
Reglamento (UE) 2022/2554, DO L 333 de 27.12.2022; aplicable desde el 17.1.2025
Regulator
National financial supervisors (in Spain, Bank of Spain, CNMV and DGSFP) and the European Supervisory Authorities
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Register and contracts for AI vendors as ICT servicesReglamento (UE) 2022/2554, arts. 28-30In forceJanuary 17, 2025Banks, fintechs, insurers and other financial entities using third-party AI.Verified in the official source on November 2, 2026
ICT risk and incident management covering AI systemsReglamento (UE) 2022/2554, arts. 5-6 y 17-19In forceJanuary 17, 2025Financial entities and insurers using AI in business processes.Verified in the official source on November 2, 2026

Register and contracts for AI vendors as ICT services

Reglamento (UE) 2022/2554, arts. 28-30In force

Applies from January 17, 2025

When it relates
Banks, fintechs, insurers and other financial entities using third-party AI.
What the rule provides
  • Add every AI vendor to the register of ICT third-party information.
  • Assess concentration risk and criticality before contracting.
  • Contracts with audit rights, service levels, data location and exit strategy.
Typical evidence
  • ICT third-party register.
  • Vendor contracts and risk assessments.
Verification
Verified in the official source on November 2, 2026Application date checked on EIOPA's official DORA page.

ICT risk and incident management covering AI systems

Reglamento (UE) 2022/2554, arts. 5-6 y 17-19In force

Applies from January 17, 2025

When it relates
Financial entities and insurers using AI in business processes.
What the rule provides
  • Include AI systems in the ICT risk management framework.
  • Classify and report major ICT incidents, including those caused by AI failures.
  • Maintain continuity and rollback plans for AI-enabled services.
Typical evidence
  • ICT risk framework naming AI systems.
  • Incident log and reports.
Related base documents
Verification
Verified in the official source on November 2, 2026Application date checked on EIOPA's official DORA page.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)