Who Must Comply with the EU Digital Operational Resilience Act (DORA)?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• All EU - authorized financial entities (21 categories) must follow DORA’s ICT risk - management, incident - reporting, and resilience testing rules.
• Any ICT third - party service provider that supplies those entities, regardless of location, is in scope and must embed DORA - compatible contract clauses.
• Small - scale or micro - SME financial firms are exempt, but may still face contractual DORA obligations from their clients.

Who is covered by DORA?

DORA covers two broad groups: regulated financial entities in the EU and the ICT third - party service providers that serve them. The regulation’s Article 2 defines the scope and it is enforced across all EU Member States as of 2025 - 2026.

Which financial entities must comply?

The regulation lists 21 categories of financial entities, from banks to crypto - asset service providers. Below is a concise table of the categories and typical examples:

These entities must implement ICT risk - management frameworks, incident - reporting procedures, resilience testing, and third - party risk controls as required by DORA.

What about ICT third - party service providers?

Any company that provides ICT services - cloud hosting, data - centres, software, managed services, etc. - to the financial entities listed above falls within DORA’s scope, even if the provider is headquartered outside the EU. They must:

1. Include DORA - compatible clauses in contracts (audit rights, incident - response support, exit - strategy provisions).
2. Allow supervisory authorities to request information and perform oversight.
3. If designated as a Critical ICT Third - Party Provider (CTPP), accept direct EU - wide supervision by the European Supervisory Authorities (EBA, ESMA, EIOPA).

Which entities are exempt?

DORA does not apply to certain micro - SME or small - scale financial entities, including:

• Small insurance or re - insurance undertakings classified as micro - SMEs.
• Insurance intermediaries that are micro - SMEs or SMEs.
• Institutions for occupational retirement provision with fewer than 15 members.
• Certain natural or legal persons covered only by MiFID II.
• Post - office giro institutions. These entities are not subject to DORA’s mandatory requirements, though they may still need to comply with contract clauses imposed by in - scope clients.

How to determine your organization’s DORA obligations

1. Identify your business model. If you are a bank, payment institution, crypto - asset service provider, or any of the other 20 categories, you are in scope.
2. Map your ICT supply chain. List every vendor that provides cloud, SaaS, data - centre, or managed - service components to your core financial services.
3. Check vendor status. Determine whether any vendor is classified as a Critical ICT Third - Party Provider; they will be subject to direct supervisory oversight.
4. Review exemptions. Verify if your organization qualifies as a micro - SME under the exemption criteria.
5. Update contracts. Ensure all ICT service agreements contain DORA - compliant clauses for audit, incident response, and exit strategies.

Why DORA compliance matters for developers and security teams

• Regulatory risk: Non - compliance can lead to fines, enforcement actions, and loss of market access.
• Supply - chain security: The act forces explicit risk - management and monitoring of third - party services, reducing hidden vulnerabilities.
• Operational resilience: Implementing DORA’s testing and incident - response requirements improves your ability to withstand cyber incidents.

How Decloak helps you meet DORA requirements

Decloak’s free scan evaluates core security layers, including HTTP/TLS posture, static HTML analysis, rendered - page network behaviour, JavaScript CVE detection, tag - manager intelligence, third - party domain mapping, and vibe - coded platform security. The vibe - coded platform security layer identifies common misconfigurations in platforms such as Supabase, Bubble, and Next.js that often affect the ICT components of financial services. While Decloak does not replace full DORA compliance programs, its quick 15 - second graded report can surface critical issues in your web - application stack that need remediation before a formal DORA audit.

Next steps

• Run a free Decloak scan on your public URLs to get an immediate security posture snapshot.
• Conduct a detailed DORA gap analysis for each financial entity and ICT provider in scope.
• Incorporate DORA - compliant clauses into all third - party contracts.
• Establish an ongoing monitoring program using Decloak’s paid tiers for multi - page crawling, evidence packages, and active testing if deeper validation is required.

References: EU DORA Article 2, Vanta, IBM, EIOPA, and other listed sources.