DORA Article 45 Explained: Information-Sharing Rules

Article 45 of DORA (the EU’s Digital Operational Resilience Act, Regulation (EU) 2022/2554) lets financial entities exchange cyber threat information and intelligence with each other, provided the exchange meets three conditions at once: it aims to enhance digital operational resilience, it takes place within trusted communities of financial entities, and it runs through arrangements governed by rules of conduct that respect business confidentiality, personal data protection and competition policy. Joining is your choice. The obligations that attach to membership bind you from the day it is validated.

Article 45 sits alone in Chapter VI of DORA. One chapter, one article, and the legal text carries the full weight here. DORA gives the European Supervisory Authorities no mandate to write technical standards or guidelines beneath it, and they haven’t: their Joint Guidelines on oversight cooperation (JC/GL/2024/36) run to Articles 31 to 44, the oversight framework for critical ICT third-party service providers, and stop there.

The operative sentence reads: "Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing:". Three conditions follow. DORA says financial entities "may" exchange, so nothing here obliges you to join anything.

The three conditions

The exchange has to aim at improving digital operational resilience, through raising awareness of cyber threats, limiting their ability to spread, supporting defence capabilities and detection techniques, or supporting mitigation, response and recovery. It has to happen inside trusted communities of financial entities, a phrase DORA leaves undefined in its Article 3 definitions. Publishing to the open web, or sharing with entities outside the financial sector, generally sits outside what Article 45 permits.

And it has to run through arrangements that protect the sensitive nature of what is shared, under rules of conduct respecting business confidentiality, personal data protection in accordance with Regulation (EU) 2016/679 (the EU General Data Protection Regulation, or GDPR) and guidelines on competition policy. Miss one and the exchange loses its Article 45 cover, however useful the intelligence is. That’s true inside an otherwise well-run community as much as outside it.

What the arrangement’s terms have to define

Article 45(2) puts the governance burden on the arrangement itself. Its terms must define the conditions for participation and, where appropriate, set out the involvement of public authorities and the capacity in which they may be associated with it, the involvement of ICT third-party service providers, and operational elements including the use of dedicated IT platforms. Ask to see that documentation before you commit. An arrangement that can’t produce it falls short of the Article 45 standard, and at the next supervisory review the gap is yours to explain.

The notification obligation

Article 45(3) carries the one binding duty in the article. Once your membership is validated you notify your competent authority, meaning the authority designated for your entity type under Article 46. When membership ceases you notify again, once the cessation takes effect. Put both events in the compliance calendar alongside your register of information updates, because they’re easy to lose in a year when nothing else about the arrangement changes.

Article 45(1) names the shareable categories directly, and the safeguards condition in point (c) draws the line on the other side. The permission covers information and intelligence, which are separate things in DORA’s own vocabulary: Article 3 reserves threat intelligence for material "aggregated, transformed, analysed, interpreted or enriched" to the point where it gives a decision-maker the context to act. A raw list of hashes is shareable either way. What it gives your triage step is a lookup, and the enriched version is what tells you whether to act.

The GDPR boundary catches teams more often than the competition one. Threat feeds carry email addresses, usernames and device identifiers tied to individuals, and those stay personal data whatever the cyber framing around them. Most summaries of Article 45 stop at "GDPR applies", where Recital 34 goes further and directs these mechanisms to operate on one or more of the legal bases in Article 6 GDPR, naming legitimate interest as an example. So the question to put to legal is which Article 6 basis applies here, and where that reasoning gets written down.

The competition boundary comes up less often and carries the same weight. Recital 34 points at the Commission’s Communication of 14 January 2011 on applying Article 101 of the Treaty on the Functioning of the European Union (TFEU) to horizontal co-operation agreements. Worth knowing before you draft anything: the Commission replaced it with revised Horizontal Guidelines in 2023, so terms written against the 2011 text are citing a superseded source even though DORA’s recital still points there. Keep shared content to technical threat data and the question rarely surfaces at all.

DORA binds financial entities authorised or registered in the EU. A UK-headquartered group meets Article 45 through its EU-authorised entities, while its UK-only businesses sit under the separate Prudential Regulation Authority and Financial Conduct Authority operational resilience regime. That distinction shapes which community is the right one, because the governance terms that satisfy a competent authority in Dublin or Frankfurt are the ones Article 45(2) describes.

For most EU financial entities the practical route is an established sector body. FS-ISAC, the Financial Services Information Sharing and Analysis Center, runs global membership with regional structures, and its UK arm became steward of the Financial Sector Cyber Collaboration Centre in November 2025. CIISI-EU, the Cyber Information and Intelligence Sharing Initiative created by members of the Euro Cyber Resilience Board that the European Central Bank convenes, is a closed community by design: its members are pan-European financial infrastructures, central banks acting in an operational capacity, critical service providers, ENISA (the EU Agency for Cybersecurity) and Europol, so a bank or insurer will look elsewhere. Several national competent authorities run or endorse their own sector communities too, and that’s a call worth making before you look further afield.

Building your own arrangement stays open to you. Article 45 requires membership of no particular body, and a bilateral arrangement between two firms qualifies as long as its terms meet Article 45(2). The work sits in drafting those terms and keeping them current, and that work lands on whoever convenes the arrangement.

Membership and operation are separate achievements, and the gap between them is where most Article 45 programmes lose their evidence trail.

1. Ingest means each item lands in a logged, access-controlled channel carrying its source and a timestamp.
2. Assess means triaging it against your asset register and current risk profile: does this indicator exist in your environment, and would your detection rules catch this technique?
3. Act means a control update, an alert to your security operations centre (SOC), a detection rule change or an escalation into incident response, with the reasoning recorded on the occasions where the right answer was to change nothing.

That loop is only as good as the links between its three stages, and those links are what a supervisory review actually reads. SureCloud holds the asset register, control library and incident workflow in the same environment the intelligence lands in, so a triage decision references live control coverage and an action traces back to the item that prompted it. Gracie AI Agents with Personas and Skills performs the assessment activities that otherwise queue behind one analyst, working to Skills your own team has codified once, so the hundredth triage matches the first. Every action an agent takes is written to an immutable reasoning log, which is the kind of record a supervisory review of your arrangement will ask to see.

Senior Agent Collaboration picks up the items that span domains. A campaign against a critical provider touches the risk register, control coverage and vendor management at once, and each part reaches its owner the same day.

Information sharing is the fifth of DORA’s five core requirements, and the only one measured by what it does to the other four.

Name an owner on each of those four receiving ends before the first item lands, or triage output stops at the triage queue. Two of the four carry obligations of their own the moment intelligence reaches them: an escalation has to clear the reporting clocks set out in DORA’s incident response governance requirements, and an input to testing scope has to survive the authority’s review of your threat-led penetration testing plan. Both of those routes get looked at in a review, so write down who owns each one.

The feed collector

The firm joins, integrates, and starts receiving. Six months on, the feed lands in a shared inbox or a chat channel with no named owner, no triage step and no route to the risk register. Background noise, effectively. The tooling is usually fine, and what’s missing is a person whose job it is to read what arrives.

Article 45 leaves you free to conclude that a given item needs nothing from you, and on its own it asks for no record of that decision. The documentation obligation sits elsewhere in DORA: Article 6(1) requires a well-documented ICT risk management framework, and Article 13(1) requires capabilities and staff to gather information on vulnerabilities and cyber threats. Assign a named owner for triage, set a minimum weekly cadence, and log the outcome even when the outcome is "no exposure in our environment". Those log entries are what you show when someone asks what the membership produced.

The legal freeze

The second pattern runs the other way. The firm wants to contribute, legal raises GDPR and competition concerns, nobody can agree a scrubbing protocol, and contribution stalls. Both concerns are legitimate. They’re usually settled once someone writes the protocol down and legal signs it.

For GDPR, establish a pre-sharing pseudonymisation step, identify which Article 6 basis covers any residual personal data, and document both. For competition law, limit contributions to technical threat data and exclude commercial, strategic and operational context by rule, so nobody has to make the same judgement call twice. Once legal and compliance have signed off a repeatable process, contributions can go out without a fresh legal review each time.

Use this when evaluating a community to join, or when drafting terms of your own. The first four come straight from Article 45(2) and the fifth from Article 45(3); the rest are what supervisory reviews have been asking to see.

1. Participation conditions: who is eligible, how membership is validated, and the grounds for removal.
2. Public authority involvement: whether competent authorities or other public bodies take part, and in what capacity.
3. ICT third-party involvement: whether managed service providers or cloud platforms can participate, and under what constraints.
4. Operational platform detail: which systems carry the exchange, and the security controls applied to them.
5. Notification process: how members notify their competent authority on joining and on cessation, under Article 45(3).
6. Information classification rules: what may be shared, and how members label content before it goes out.
7. Data protection protocol: how personal data is identified and removed, and the Article 6 GDPR basis for anything that remains.
8. Competition compliance: explicit exclusion of commercial, pricing and strategic information, with the applicable guidelines named.
9. Confidentiality obligations: what members may do with intelligence received, and what requires the originator’s consent.
10. Escalation pathway: how an active or imminent threat reaches members, and authorities, faster than the standard cadence.

An arrangement that can evidence all ten has done the Article 45(2) work for you. Where it can only evidence some of them, the rest become yours to document, and it’s you the competent authority will ask.