DORA deadlines and timeline: the key dates
When did DORA enter into force, and since when does it apply?
Because DORA is a regulation (Regulation (EU) 2022/2554), it applies directly in every member state. National transposition as under NIS2 was not needed. National rules only accompany enforcement, for example by assigning competences to the national financial supervisor.
| Date | Milestone |
|---|---|
| 14 December 2022 | DORA adopted as Regulation (EU) 2022/2554 |
| 16 January 2023 | Entry into force (20 days after publication in the Official Journal, Art. 64) |
| 17 January 2025 | Date of application: all requirements must be met from this date (Art. 64) |
| since 2024/2025 | Technical standards (RTS/ITS) specify reporting, the register of information and TLPT |
| ongoing | Annual testing of critical systems (Art. 24(6)), TLPT at least every 3 years (Art. 26(1)) |
Which reporting deadlines apply to major ICT-related incidents?
The reporting chain itself is in Art. 19(4) DORA (initial notification, intermediate report, final report). The specific deadlines are set by Delegated Regulation (EU) 2025/301:
- Initial notification: as early as possible, within 4 hours of classifying the incident as major, in any case at the latest 24 hours after becoming aware.
- Intermediate report: within 72 hours of the initial notification, even if the status has not changed.
- Final report: at the latest one month after the last intermediate report.
If a deadline falls on a weekend or a public holiday, many financial entities may report by noon of the next working day (Art. 5(4) of the Delegated Regulation). That does not apply to entities that also fall under NIS2 as essential or important entities. Whether your team keeps to these deadlines under time pressure can be trained in an exercise.
What do the technical standards (RTS/ITS) govern?
Many detailed obligations are governed by regulatory and implementing technical standards of the European Supervisory Authorities (ESAs). They include the classification of incidents, the content and deadlines of reports (Delegated Regulation (EU) 2025/301), the register of information on ICT third-party providers and the conduct of TLPT in line with the TIBER-EU framework (Art. 26(11)). These standards took effect step by step in 2024 and 2025 and apply on an ongoing basis.
Which testing cycles does DORA prescribe?
- At least yearly: tests of all ICT systems and applications supporting critical or important functions (Art. 24(6)).
- At least yearly: testing of the ICT business continuity plans, the response and recovery plans and the crisis communication plans (Art. 11(6)).
- At least every three years: threat-led penetration testing for designated financial entities (Art. 26(1)). The authority can adjust the frequency. Details under DORA resilience testing and TLPT.
Which obligations are ongoing?
DORA is not a one-off project. Ongoing obligations are incident reporting, a maintained register of information on all contractual arrangements with ICT third-party providers, the annual testing programme (Art. 24) and the regular testing of response and recovery plans. So set the exercise and test dates in a fixed annual plan, for example quarterly tabletop exercises and one plan test a year. Then you meet the cycles in an evidenced way and do not have to chase any deadline.
Frequently asked questions
Since when does DORA apply?
DORA (Regulation (EU) 2022/2554) entered into force on 16 January 2023 and has applied directly in all EU member states since 17 January 2025 (Art. 64). National transposition as under NIS2 was not needed. There was no further transition period.
Which reporting deadlines apply to ICT incidents under DORA?
The deadlines are set in Delegated Regulation (EU) 2025/301: initial notification within 4 hours of classifying the incident as major, at the latest 24 hours after becoming aware; intermediate report within 72 hours of the initial notification; final report at the latest one month after the last intermediate report.
How often must testing take place under DORA?
All ICT systems supporting critical or important functions are to be tested at least yearly (Art. 24(6)); business continuity, response and recovery plans also at least yearly (Art. 11(6)). For designated financial entities, TLPT at least every three years is added (Art. 26(1)).
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.