DORA

DORA (Regulation 2022/2554) has applied across the EU since January 2025, the most mature of the EU's product security regimes and the one already being enforced.

It's narrower than NIS2, financial entities only, but reaches further. Its contractual requirements flow down to any ICT provider serving those entities, and regulators can designate the few whose failure would be systemic as "critical," supervising them directly even though they aren't financial firms.

Selling to a bank puts DORA in your contract. Being systemically important puts a regulator in your business.

Discussion prompts

• If you sell software to an EU financial entity, do you know which DORA terms flow down into your contract?
• What would change in your contracts if a regulator, not just your customer, could supervise you directly?
• Why might a sector-specific regime like DORA enforce harder than a horizontal one like the CRA or NIS2?