DORA one year on: what supervisors are focusing on

Why it matters

The EU Digital Operational Resilience Act has applied since January 2025. Supervisors are now looking beyond policies to whether firms can evidence control of ICT risk across their providers, incidents and testing.

Many firms treated the first year as a documentation exercise. Supervisors are now testing whether registers, contracts, incident processes and resilience tests line up, and whether boards understand the dependencies behind critical services.

What's changing

• Registers of ICT third-party arrangements give supervisors a view of concentration risk across the sector.
• Major ICT-related incidents must be classified and reported within set timeframes, which tests internal detection and escalation.
• Critical ICT third-party providers are coming under direct EU oversight.

How leaders are responding

• Reconciling contract inventories with the services each business function actually depends on.
• Running incident-reporting drills so classification decisions can be made quickly.
• Preparing exit and substitution plans for providers that support critical or important functions.

What good looks like

• A complete, tested register of ICT third-party arrangements
• Exit plans for critical providers that have been rehearsed, not just written
• Incident classification that meets DORA reporting deadlines without manual rework

What to watch

• The oversight regime for critical ICT third-party providers.
• Threat-led penetration testing requirements for larger firms.
• Supervisory findings published after the first reporting cycles.

Where to start