DORA Enforcement 2026: What Financial Entities Must Do Now

DORA's five core requirements have been mandatory since January 2025. The regulatory technical standards (RTS) and implementing technical standards (ITS) that specify how each requirement must be met were finalised by the ESAs and adopted by the European Commission through delegated and implementing regulations published throughout 2024. These standards are now law in all EU member states without the need for national transposition.

Enforcement runs through national competent authorities, with ESA direct oversight reserved for critical ICT third-party providers (CTPPs). In practice, the national competent authority for each financial entity, determined by its home member state, is responsible for assessing compliance, issuing findings, and imposing sanctions where necessary. The BaFin in Germany, the AFM and DNB in the Netherlands, the Banque de France and ACPR in France, and the Central Bank of Ireland are all implementing the ESAs' joint supervisory convergence priorities in their domestic markets.

In the first enforcement cycle, supervisory activity has concentrated in three areas: desk-based reviews of submitted documentation (ICT risk management frameworks and Register of Information submissions), targeted supervisory interviews with Chief Information Officers and heads of operational resilience, and thematic reviews across sectors focused on specific DORA pillars, particularly ICT third-party risk and digital operational resilience testing programmes.

ESA Supervisory Priorities for 2026

The supervisory table below maps each pillar to the specific areas competent authorities are examining in 2026. For a detailed explanation of how the five pillars connect and what each requires in practice, see our guide to the five pillars of DORA.

Based on the ESAs' published supervisory convergence work and national competent authority reviews, the following programme gaps are the most frequently identified across in-scope financial entities.

ICT risk management framework: board approval required

DORA Article 5 requires the management body of the financial entity to define, approve, oversee, and be accountable for the ICT risk management framework. A framework sitting within the CIO function falls short of this requirement unless the board has formally endorsed it. Supervisors are specifically asking for board resolutions or equivalent evidence of formal approval.

Register of Information: completeness and accuracy gaps

Article 28(3) requires financial entities to maintain and update a complete register of contractual arrangements with all ICT third-party service providers. Commission Implementing Regulation (EU) 2024/2956 specifies the exact data fields. Reviews have consistently found sub-contractors uncaptured in most submissions, service classification data incorrect, and the distinction between critical and non-critical functions missing from the majority of submissions.

Incident classification thresholds: operationalisation gaps

DORA's incident reporting framework requires financial entities to classify ICT-related incidents as major or minor based on criteria including the number of clients affected, duration, geographic spread, data losses, and reputational impact. Article 18 sets the classification criteria, and the RTS on major incident reporting specifies the thresholds.

The gap is operational: classification criteria need to be mapped to live monitoring and alerting systems. Many entities have the policy framework in place; the connection to their actual monitoring infrastructure is what's absent.

TLPT programme: significant entities yet to start

Threat-Led Penetration Testing (TLPT) under DORA Articles 24-27 applies to significant entities designated by competent authorities. TLPT is a complex, structured exercise based on the TIBER-EU framework, requiring red team testing across live production systems. It must be conducted at least every three years. Many designated entities have yet to initiate their TLPT programme, making it one of the clearest and most verifiable supervisory findings in the current enforcement cycle.

ICT concentration risk: assessment obligation outstanding

Article 29 requires financial entities to identify and manage ICT concentration risk: the risk from over-reliance on a single ICT third-party provider or a small number of providers across critical functions. Many financial entities have completed their Register of Information but have yet to conduct the concentration risk analysis Article 29 requires. The Register is the input; the analysis is the obligation.

For entities with incomplete DORA programmes, the following actions carry the highest priority in 2026, based on supervisory focus and the enforcement risk associated with each gap.

Immediate (0-3 months)

1. Obtain board approval for the ICT risk management framework. Schedule a board or board committee presentation. Document the approval with a board resolution or equivalent minute.
2. Complete and validate the Register of Information against the Commission Implementing Regulation (EU) 2024/2956 template. Verify service classifications, critical function flags, and sub-contractor data for every provider.
3. Operationalise incident classification procedures. Map DORA Article 18 classification criteria to your existing monitoring alerts. Test the three-stage reporting workflow: initial notification within 4 hours of major incident classification, intermediate report within 72 hours, final report within one month.

Near-term (3-6 months)

1. Conduct an ICT concentration risk assessment using the completed Register of Information. Identify services where more than one critical function depends on the same provider.
2. Review ICT third-party contracts for DORA Article 30 compliance: exit plan provisions, audit rights, service continuity obligations, and sub-contracting controls.
3. For entities designated for TLPT, engage a TIBER-EU accredited red team provider and initiate programme scoping. Act before a supervisory review arrives.
4. Establish an information sharing mechanism by joining a sector ISAC (Information Sharing and Analysis Centre) or by setting up bilateral threat intelligence sharing arrangements.

Programme maturity (6-12 months)

1. Integrate DORA's ICT risk management framework with enterprise risk management. ICT risks should appear in the board risk report alongside financial and operational risk.
2. Establish basic digital operational resilience testing for all entities: scenario-based testing covering critical ICT systems, recovery time objective testing, and business continuity exercise outcomes.
3. Implement ongoing monitoring of the Register of Information. Contractual changes, new ICT providers, and critical function reclassifications must be reflected in real time.

Managing a DORA compliance programme across all five pillars generates a volume of documentation that spreadsheet-based tracking can't sustain. Gracie AI Agents with Personas and Skills performs activities across Register of Information maintenance, control evidence collection, and incident classification workflows, cutting audit preparation time by 75%. That means your compliance evidence is already assembled and auditable when a supervisory review arrives. See our DORA compliance guide for a structured framework covering all five pillars.

DORA has been fully enforceable since 17 January 2025. Competent authorities have had full enforcement powers from that date, and the regulation requires national law to provide for administrative penalties that are effective, proportionate, and dissuasive. Article 52 requires penalties of up to 2% of total annual worldwide turnover for financial entities in serious breach. The specific sanctions available vary by member state, but the enforcement framework is active across all EU jurisdictions.

For CTPPs under direct ESA oversight, DORA Article 35 gives the Lead Overseer the power to conduct investigations and on-site inspections, issue recommendations, and impose periodic penalty payments. The first CTPP oversight programmes are underway in 2025-2026 and are being closely watched by the financial entities that depend on those providers, since Article 30 requires CTPPs to cooperate with oversight and to ensure their financial entity clients can meet their DORA obligations.

For practical guidance on what board-level DORA reporting requires, see our guide to DORA board reporting and ICT risk.