Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
DORA
Règlement sur la résilience opérationnelle numérique, règlement (UE) 2022/2554
Gestion des risques ICT, signalement des incidents, tests de résilience et registre des accords avec des tiers prestataires de services ICT pour le secteur financier.
The law in brief
DORA, the Digital Operational Resilience Act, sets one EU-wide rulebook for how financial entities manage information and communication technology risk. It covers risk management, incident reporting, resilience testing and, unusually, the ICT providers the financial sector depends on.
It is a regulation, so it applies directly across the EU, and it has applied since 17 January 2025. Detailed technical standards fill in much of the practice.
À qui elle s’applique
- Financial entities, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, insurers and reinsurers, and many others listed in Article 2.
- ICT third-party service providers serving them, with the most critical designated for direct EU oversight.
- A simplified framework applies to some smaller and less interconnected entities (Art. 16).
What it requires
An ICT risk-management framework
Keep a sound, documented framework to identify, protect against, detect, respond to and recover from ICT risk. The management body is ultimately responsible for it.
Report major ICT-related incidents
Classify ICT-related incidents against the regulatory criteria and report major ones to the competent authority in initial, intermediate and final reports, within the time limits set by the technical standards.
Resilience testing
Run a testing program appropriate to your size and risk, and, if selected by your authority, threat-led penetration testing at least every three years.
Manage ICT third-party risk
Keep a register of information on every ICT third-party arrangement, assess concentration risk, and have exit strategies for services supporting critical or important functions.
Required contract terms
Include the terms DORA lists in ICT service contracts, such as service descriptions, locations of processing, security, access and audit rights, termination rights and, for critical functions, exit support.
Enforcement and penalties
Les États membres fixent les sanctions administratives et les mesures correctives (art. 50). Les prestataires tiers critiques de services ICT surveillés au niveau de l’UE peuvent se voir infliger des astreintes pouvant atteindre 1% de leur chiffre d’affaires mondial quotidien moyen pour chaque jour de non-conformité, pendant six mois au maximum (art. 35).
What to do first
- Confirm your entity type, and whether the simplified framework applies.
- Have your management body approve the ICT risk-management framework and own it.
- Build the register of information on all ICT third-party arrangements.
- Classify incidents against the regulatory criteria and rehearse the reporting timeline for major incidents.
- Update ICT contracts with the Article 30 clauses and exit strategies.
- Plan resilience testing, and threat-led penetration testing if you are selected.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Évolutions récentes
Rien de signalé pour l’instant. Regulatory Watch recense les nouvelles règles, les mesures d’application et les décisions de justice au fur et à mesure.
Sources
- Règlement (UE) 2022/2554 EUR-Lex · Texte officiel ou régulateur
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles