More than a year after the Digital Operational Resilience Act (Regulation EU 2022/2554) began applying to EU financial entities on 17 January 2025, many compliance teams are discovering that the hard part was never the deadline. It is the ongoing work of staying compliant.
According to RegTech provider Vixio, DORA built a single framework for ICT risk across the financial sector on five pillars: ICT risk management, incident reporting, digital operational resilience testing, third-party risk management and information sharing.
Its reach covers banks, payment institutions, e-money institutions, investment firms and crypto-asset service providers. ICT providers face contractual obligations, and those designated as critical fall under a separate EU oversight regime.
The scale of the reporting challenge became clear before the rules even took effect. In the European Supervisory Authorities’ 2024 dry run, only 6.5% of the 947 analysed registers passed all 116 data quality checks.
Common failings included wrong file formats, blank mandatory fields, mishandled identifiers and incomplete links between contracts, functions and supply-chain data. Although the exercise was voluntary, it showed how easily a finished spreadsheet can fall short of a submission-ready register.
That gap widens for firms operating across multiple jurisdictions. National competent authorities issue their own collection instructions, filing windows, templates and taxonomy versions, often in different languages.
Teams must also track a steady flow of regulatory technical standards, implementing technical standards, guidelines and Q&As, which hold much of the practical detail on incident classification, register structure and subcontracting chains. As supervisory scrutiny intensifies through 2026, these secondary standards are likely to decide whether submissions hold up.
Third-party oversight adds further strain. Procurement records are not enough; firms must map ICT contracts to the functions they support, assess concentration risk and keep exit plans workable.
Governance is equally demanding. The management body retains ultimate accountability for ICT risk, and delegating a task or outsourcing a service does not shift that responsibility. Supervisors expect a documented trail showing when a requirement was identified, how it was assessed and who acted on it, something email threads and Slack messages rarely provide.
Incident reporting raises the stakes again. Major ICT incidents require an initial notification, intermediate reporting and a final report, each within strict time limits, often while IT is still fighting the disruption.
This is where RegTech providers such as Vixio see an opening. The firm, which says it serves more than 500 organisations including Flywire, SumUp and Trust Payments, pairs AI-powered monitoring with in-house analysts who review DORA developments before publication.
Updates are tagged as actionable, indicative or informative, and compliance teams can turn them directly into tasks assigned to colleagues in IT, legal or risk, building an audit trail along the way. The platform also covers PSD3, AMLA, MiCA, NIS2, FIDA and the AI Act.
Read the full Vixio post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
