DORA Articles — Regulation (EU) 2022/2554

All 64 articles of Regulation (EU) 2022/2554 (DORA) reproduced from the official consolidated text, one page per article.

SOURCE: REGULATION (EU) 2022/2554 ↗

In force Official consolidated text Checked against EUR-Lex on 19 Oct 2026

Plain-language guide: DORA explained. Every article below reproduces the official text; append .md to any article URL for Markdown.

Articles

Art.	Title (from EUR-Lex)	Verified
1	Subject matter	✓
2	Scope	✓
3	Definitions	✓
4	Proportionality principle	✓
5	Governance and organisation	✓
6	ICT risk management framework	✓
7	ICT systems, protocols and tools	✓
8	Identification	✓
9	Protection and prevention	✓
10	Detection	✓
11	Response and recovery	✓
12	Backup policies and procedures, restoration and recovery procedures and methods	✓
13	Learning and evolving	✓
14	Communication	✓
15	Further harmonisation of ICT risk management tools, methods, processes and policies	✓
16	Simplified ICT risk management framework	✓
17	ICT-related incident management process	✓
18	Classification of ICT-related incidents and cyber threats	✓
19	Reporting of major ICT-related incidents and voluntary notification of significant cyber threats	✓
20	Harmonisation of reporting content and templates	✓
21	Centralisation of reporting of major ICT-related incidents	✓
22	Supervisory feedback	✓
23	Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions	✓
24	General requirements for the performance of digital operational resilience testing	✓
25	Testing of ICT tools and systems	✓
26	Advanced testing of ICT tools, systems and processes based on TLPT	✓
27	Requirements for testers for the carrying out of TLPT	✓
28	General principles	✓
29	Preliminary assessment of ICT concentration risk at entity level	✓
30	Key contractual provisions	✓
31	Designation of critical ICT third-party service providers	✓
32	Structure of the Oversight Framework	✓
33	Tasks of the Lead Overseer	✓
34	Operational coordination between Lead Overseers	✓
35	Powers of the Lead Overseer	✓
36	Exercise of the powers of the Lead Overseer outside the Union	✓
37	Request for information	✓
38	General investigations	✓
39	Inspections	✓
40	Ongoing oversight	✓
41	Harmonisation of conditions enabling the conduct of the oversight activities	✓
42	Follow-up by competent authorities	✓
43	Oversight fees	✓
44	International cooperation	✓
45	Information-sharing arrangements on cyber threat information and intelligence	✓
46	Competent authorities	✓
47	Cooperation with structures and authorities established by Directive (EU) 2022/2555	✓
48	Cooperation between authorities	✓
49	Financial cross-sector exercises, communication and cooperation	✓
50	Administrative penalties and remedial measures	✓
51	Exercise of the power to impose administrative penalties and remedial measures	✓
52	Criminal penalties	✓
53	Notification duties	✓
54	Publication of administrative penalties	✓
55	Professional secrecy	✓
56	Data Protection	✓
57	Exercise of the delegation	✓
58	Review clause	✓
59	Amendments to Regulation (EC) No 1060/2009	✓
60	Amendments to Regulation (EU) No 648/2012	✓
61	Amendments to Regulation (EU) No 909/2014	✓
62	Amendments to Regulation (EU) No 600/2014	✓
63	Amendment to Regulation (EU) 2016/1011	✓
64	Entry into force and application	✓

Verbatim reproduction from the official text. These pages reproduce the regulation word for word from the official source on EUR-Lex. They are not legal advice. This is not an official publication — only the electronic edition of the Official Journal of the European Union is authentic (Council Regulation (EU) No 216/2013, Article 1(2)).