The rules, in plain words
DORA
Digital Operational Resilience Act · Regulation (EU) 2022/2554 · EU
Financial firms must prove they can keep running when their technology fails - including when the failure is at a supplier like AWS.
Who it applies to. Financial entities in the EU - banks, insurers, investment firms, payment institutions and more - plus the ICT providers that serve them. If you sell technology into an EU financial firm, DORA reaches you through their contract with you.
In plain words
Regulators noticed that a bank can be perfectly solvent and still stop working because a cloud region went down or a supplier was breached. DORA is the response: it makes operational resilience a supervised obligation rather than an internal engineering concern.
The core demand is unglamorous. Know what your technology dependencies actually are, write them down, keep the list current, test that you could survive losing them, and be able to show all of that to a supervisor on request.
The part that catches people is third-party risk. You have to maintain a register of your ICT contracts, assess concentration risk before you sign, and hold an exit plan for anything supporting an important function - an exit plan that would actually work, not one that exists as a document.
Timing
When it applies.
- 17 January 2025
- DORA became applicable across the EU. The obligations are live now, not upcoming.
What it means for your architecture
The part that is decided at design time.
- Your dependency inventory has to be real and per-workload, not a list of vendor names.
- Recovery objectives have to be demonstrable under test, not asserted in a policy document.
- Exit and portability have to be designed in. Retrofitting an exit path to a deeply proprietary estate is the expensive version of this problem.
- The register of information has to match the estate as it is today, which makes it an ongoing architectural discipline rather than an annual document exercise.
Read the real thing
This is an engineering explainer, not legal advice. How the rules apply to your organisation is a question for your counsel and your compliance function. What your architecture can evidence against them is the question Northkeep answers.
Also worth knowing
The other rules in play.
-
NIS2
Medium and large organisations across 18 sectors must manage cybersecurity risk properly, report significant incidents fast, and hold their management personally accountable for it.
-
US CLOUD Act
US authorities can compel a US-based provider to hand over data it controls, even when that data is stored on servers in Europe.
-
EU AI Act
AI systems are sorted by how much harm they could do, and the riskier ones carry real obligations - documentation, human oversight, logging and data governance.