DORA

Not directly, in almost every case. DORA binds the EU financial entities listed in Article 2, plus ICT third-party service providers that the European Supervisory Authorities designate as critical, who come under direct EU oversight in their own right. A US or UK software vendor is normally neither. It still reaches you through contract: your customer cannot comply with Articles 28 to 30 unless your agreement carries the terms those articles require, so the obligation arrives as an addendum with a signature deadline attached. The practical question is therefore not whether you are regulated, but whether you can evidence audit rights, subcontracting disclosure, service levels, and a documented exit plan when a bank asks.

January 17, 2025, under Article 64 of Regulation (EU) 2022/2554. There is no phase-in for the core obligations, which is why contract remediation programs at European financial entities ran hard through 2025 and are still working through vendor tails today. The first list of critical ICT third-party service providers designated by the European Supervisory Authorities followed on November 18, 2025.

Three reports, on three clocks, set by Commission Delegated Regulation (EU) 2025/301. The initial notification goes in as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from the moment the entity became aware of it. The intermediate report follows within 72 hours of the initial notification, even if nothing has changed. The final report is due no later than one month after the intermediate report, or after the latest updated intermediate report where there is more than one. The four-hour clock is the one that catches teams out, because it starts at classification rather than at containment.

It requires testing, and for some entities it requires a specific and demanding form of it. Article 24(6) obliges financial entities other than microenterprises to test all ICT systems and applications supporting critical or important functions at least once a year, and Article 24(4) requires the testing to be done by independent parties, internal or external, without conflicts of interest. Article 25 lists the acceptable test types, penetration testing among them. Separately, entities that competent authorities identify under Article 26 must carry out threat-led penetration testing at least every three years, on live production systems, covering several or all critical or important functions, and ICT third-party providers supporting those functions are pulled into scope of the exercise.

A large part of it, and you should. Access control, change management, logging, backup and recovery, and vendor due diligence evidence transfers with light rework. What does not transfer is the part that makes DORA distinctive: the Register of Information, the incident classification thresholds and their reporting clocks, the Article 30(3) contractual set, documented exit strategies, and threat-led penetration testing where it applies. If a provider tells you a SOC 2 report makes you DORA compliant, that is a sales claim rather than a compliance position. If your ICT estate is small, your customer contracts are already remediated, and you are not identified for TLPT, you may need a short gap assessment rather than an engagement, and we will tell you so.