DORA Compliance in 2026: The Deadline Passed a Year Ago, and That Is the Real Risk

Quick Answer: The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has been in force since 17 January 2025. There is no upcoming deadline to count down to — and that is exactly what makes 2026 dangerous. This is the first full year in which EU financial entities are examined against a running compliance programme, not an implementation roadmap. DORA applies to roughly 21,000 financial entities across 20 categories plus the ICT providers that serve them. Penalties can reach up to 2% of total annual worldwide turnover. If you already passed NIS2, that does not cover you here: for financial firms, DORA is stricter and takes precedence.

Most teams treated 17 January 2025 as a finish line. It was a starting line. The work that gets firms penalised in 2026 is not the policy you wrote last year — it is the evidence you cannot produce when a supervisor asks for it this year.

Yes. DORA became applicable on 17 January 2025, with no transition period and no postponement. Unlike a directive that each member state transposes on its own schedule, DORA is a regulation that applied directly and simultaneously across all 27 member states.

That single fact reshapes the risk. In 2025 the conversation was "are we ready in time." In 2026 the conversation is "can we prove it on demand." The first assessment cycles have begun, the Register of Information is being collected, and the European Supervisory Authorities (the EBA, EIOPA, and ESMA) have already designated the first critical ICT third-party providers. The era of preparation is over. The era of examination is here.

One 2026 industry figure cited at a European cybersecurity conference put the gap starkly: roughly 96% of financial services firms in the EMEA region reported their data resilience does not yet meet the standard the regulation expects. That is not a number about tiny fintechs. It includes banks, insurers, and payment institutions of every size.

DORA covers 20 types of financial entity, including banks, insurers and reinsurers, investment firms, payment and electronic money institutions, crypto-asset service providers, trading venues, and many more. It also reaches ICT third-party service providers that support these firms — which is the part most technology companies underestimate.

Here is the trap for non-financial businesses. If you build, host, or operate software for an EU financial entity, DORA reaches you through your client's contractual obligations even though you are not a bank. Your client must map you, assess you, and contractually bind you under Article 30. A critical ICT provider can even be placed under direct EU oversight, and a critical third-country provider may be required to establish an EU subsidiary so it can be supervised. If your customers include EU financial firms, DORA is already in your sales conversations whether you have read it or not.

This is the single most expensive misunderstanding we see. Many firms invested in NIS2 readiness in 2024 and 2025 and assumed it carried over. For financial entities, it does not — and the relationship runs the other way from what people expect.

DORA is lex specialis for the financial sector. In plain terms, where both could apply, DORA wins. Recital 28 of the NIS2 Directive itself states that DORA should be treated as the sector-specific law for financial entities. The provisions on ICT risk management, incident reporting, resilience testing, information sharing, and ICT third-party risk apply through DORA instead of NIS2. So a financial firm does not get to point at its NIS2 file and call the job done — it has to meet the harder, more prescriptive DORA version of each control.

The reverse is also true and useful: NIS2 still covers sectors and activities outside DORA's scope, so a financial group with non-financial subsidiaries can be juggling both. The smart move is to identify the controls the two frameworks share (access control, encryption, incident logging, audit trails) and build them once, then layer the DORA-specific requirements on top.

DORA is built on five pillars. A firm is not compliant because it is strong on one or two of them. Supervisors look across all five, and a gap in any single pillar is where findings come from.

If one DORA artefact causes the most last-minute panic, it is the Register of Information under Article 28(3). It is a machine-readable register of every contractual arrangement for ICT services provided by third parties, reported to your national competent authority in xBRL-CSV format using the official ITS templates. The supervisory authorities aggregate this data to identify critical ICT providers and to measure concentration risk across the sector.

Most national reporting deadlines for the register fall around the end of the first quarter. The reason it trips firms up is mundane and brutal at the same time: the data has to be accurate, complete, and validated against a long list of data-quality rules. If your contract metadata lives in five different spreadsheets owned by three different people, assembling a clean register on a deadline is genuinely painful. The firms that do it calmly are the ones that treated vendor data as a living inventory, not a once-a-year scramble.

DORA's enforcement does not run on a single headline fine the way GDPR does. It works through your national competent authority, which can impose administrative penalties and corrective measures, with sanctions that can reach up to 2% of total annual worldwide turnover for non-compliant entities. For critical ICT third-party providers placed under direct EU oversight, the supervisory framework adds periodic penalty payments designed to force cooperation.

But the financial penalty is rarely the first thing that hurts. Supervisory findings, mandatory remediation, and the reputational cost of being named in a sector where trust is the product tend to bite earlier. In a regulated financial market, "your regulator has questions about your resilience" is a sentence that moves faster than any fine.

The window did not close, it changed shape. There is no countdown clock, which is precisely why discipline matters more now than it did during the run-up. Three moves carry the most weight.