When the cloud goes down, who answers?

DORA is the European law that makes a bank write down, in advance, what it will do when its systems go down. The name stands for Digital Operational Resilience Act.

Before DORA, the picture was scattered. Every country had its own rules: BAIT in Germany, other circulars elsewhere, and EBA outsourcing guidelines on top. ICT risk sat as a sub-item under the general operational risk heading. Meanwhile banks had long since come to depend on a handful of big cloud and software companies. One of them stumbling could stop hundreds of firms at once.

The EU's answer was a single rulebook. It has two goals: manage ICT risk in the same language from country to country, and bring the tech giants behind the banks under direct supervision for the first time.

DORA wants answers to five questions. What they all share is that the answer has to live in a working process, not on paper.

• ICT risk management

  The question it asksDo you know your risk, and who owns it?
  What it means inside a bankThe board is directly responsible for ICT risk. An asset inventory, a risk framework, backup and recovery plans must be written down and tested

• Incident management and reporting

  The question it asksWhen something breaks, how fast do you tell people?
  What it means inside a bankOnce a major incident is classified, the first notification goes in within 4 hours (no later than 24 hours after it was detected), an intermediate report at 72 hours, a final report within a month

• Resilience testing

  The question it asksDoes it actually work, and have you tried it?
  What it means inside a bankAnnual tests for everyone. For selected large firms, TLPT every three years on live systems, with teams that act like real attackers

• Third party risk

  The question it asksWho do you depend on, and what happens if they go?
  What it means inside a bankA record of every technology contract (Register of Information), mandatory contract clauses, an exit plan for critical services

• Information sharing

  The question it asksDo you share the threats you see with others?
  What it means inside a bankSharing cyber threat intelligence within the sector. Not mandatory, but encouraged

The detail people miss: The fourth pillar looked like the quietest one, but it created the most work. A bank's technology contracts number in the hundreds, and behind each of them sit more subcontractors.

The most striking finding: most of the major incidents reported in 2025 came not from hackers but from ordinary system failures and outside events.

• 3,383

  What it tells youMajor ICT incidents reported in the EU financial sector in 2025. An average of 0.18 per firm
  SourceESAs annual incident report, June 2026

• ~29%

  What it tells youShare of incidents that started at a third party provider
  SourceESAs annual incident report

• 1/3

  What it tells youShare of incidents with cross-border impact. Shared infrastructure creates a domino effect
  SourceESAs annual incident report

• ~15%

  What it tells youShare of incidents left out of the statistics because the final report didn't arrive on time
  SourceESAs annual incident report

• 19

  What it tells youCritical technology providers placed under the direct oversight of European supervisors
  SourceESAs, November 2025

• 40%

  What it tells youShare of firms in Luxembourg that had submitted their register two weeks before the deadline (16 March 2026)
  SourceCSSF

• 43%

  What it tells youShare of firms saying they spent more than 1 million euros over two years on DORA and similar compliance
  SourceRubrik Zero Labs survey

• 70%

  What it tells youShare of firms that think DORA will permanently raise their technology running costs
  SourceMcKinsey survey

• 37%

  What it tells youShare of firms saying their technology suppliers raised prices after DORA
  SourceVeeam survey, 2025

Two big tests: The TARGET payment system outage in February 2025 and the Iberian Peninsula blackout in April 2025 each triggered a large number of notifications on their own. One failure means separate reports from dozens of firms. These two events explain better than anything why DORA is so focused on shared infrastructure.

The good news: According to the report, the impact on customers and transactions stayed limited in most incidents. Detection and recovery usually worked fast.

Note: The survey figures come from different samples, and some measure DORA together with UK rules. They show the direction, not a precise measure of the market.

DORA's real achievement is drawing the first technology map of Europe's financial system. Without that map, nobody could talk about concentration risk or hold the giants to account.

• 27 countries, one language. A single regulation replaced the national rules. A group operating in more than one EU country no longer follows a separate ICT guide for each. In Germany, BAIT is fully withdrawn for banks at the end of 2026.
• Hidden dependency became visible. The registers banks submitted became the main data European supervisors used to pick the 19 critical providers. So the spreadsheet banks struggled with turned into the ruler for measuring systemic risk.
• Balance at the table with the giants. A small bank can't audit AWS or Microsoft on its own. Now European supervisors do it. A critical provider that breaks the rules can be fined up to 1% of its average daily worldwide turnover, for up to six months.
• Shared incident data. For the first time, Europe collected major ICT incidents in the financial sector under one definition and in one format. The first report, with 3,383 incidents, is the starting line for every debate from here on.
• The topic moved up to the board. ICT risk is no longer the IT manager's problem but something the board is responsible for, with its signature on it. In McKinsey's survey, the large majority of firms say they put DORA on the board's agenda.
• People started asking "what if they leave?" The mandatory exit plan for critical services brought supplier dependency, unspoken for years, to the table.
• A shared language in contracts. (Our take) Because every bank asked for the same clauses, suppliers prepared standard DORA addenda. The first year was painful, but over time a template emerged that could speed up new partnerships.

Yes, products built specifically for DORA appeared, and a category was born. Every pillar banks struggled with now has a piece of software or a service sitting across from it.

• Register automation

  What it solvesCollects supplier data and produces a validated file in the format the supervisor wants
  Example playersFormalize, OneTrust, Panorays, Prevalent

• Third party risk management (TPRM)

  What it solvesMonitors suppliers continuously, keeps questionnaires and scores, shows concentration risk
  Example playersBitSight, UpGuard, Panorays, Riskonnect

• Compliance automation (GRC)

  What it solvesBrings the five pillars together in one dashboard, produces evidence and an audit trail
  Example playersVanta, OneTrust, LogicGate, SureCloud, CyberArrow

• Incident classification and reporting

  What it solvesClassifies the incident against DORA criteria, runs the 4 hour, 72 hour and one month clocks
  Example playersDORA modules of GRC platforms

• TLPT and threat intelligence

  What it solvesRed team testing on live systems with real attacker scenarios
  Example playersRed team firms, intelligence platforms such as Filigran

• Data resilience

  What it solvesBackup, recovery and recovery from ransomware
  Example playersVeeam, Rubrik

• Cloud provider packages

  What it solvesReady made DORA mappings and contract addenda from the cloud giants for banks
  Example playersMicrosoft and the other cloud giants

• Consulting and legal

  What it solvesGap analysis, register submission, contract addendum templates
  Example playersThe Big Four, law firms

How big the market is. There's no market measure specific to DORA, but for the closest category, third party risk management, research firms put the size at between $7.7 and $10.8 billion in 2025, with 14-16% annual growth. Nearly all of them count DORA as the main growth engine in Europe. The numbers vary a lot from firm to firm; the direction is the same.

Price range. Platforms for large firms quote on request. Tools aimed at mid-sized firms show plans starting at around 900 euros a month.

Three layers of the market

1. 01Software: register, TPRM, GRC. The fastest growing layer. In 2024 most of these were general compliance tools; in 2026 there are new players positioning themselves as "built for DORA".
2. 02Services: consulting, legal, red teaming, threat intelligence. TLPT's 2028 timetable will keep this layer busy for the next two years.
3. 03The supplier side: For every SaaS company selling to banks, "we're DORA ready" is now a sales argument. A supplier that can't offer a ready contract addendum, an audit package and exit plan support is more and more often knocked out before the tender (our observation).

Watch out: Buying a tool doesn't solve the problem. The shared view in the industry is that the pain in the register comes not from the tool but from how messy the underlying data is.

The UK isn't in the EU, but it's giving its own answer to the same question. The Critical Third Parties (CTP) regime is the British version of DORA's critical provider leg.

• Legal basis

  EU (DORA)Regulation (EU) 2022/2554
  UK (CTP regime)Financial Services and Markets Act 2023

• When the rules started

  EU (DORA)17 January 2025
  UK (CTP regime)1 January 2025

• First critical provider list

  EU (DORA)18 November 2025, 19 companies
  UK (CTP regime)10 July 2026, 4 companies (in effect from 13 July)

• Who's on the list

  EU (DORA)Cloud, data centre, telecoms, IT services and financial data providers
  UK (CTP regime)AWS, Google Cloud, Microsoft, Oracle

• Who supervises

  EU (DORA)EBA, ESMA, EIOPA
  UK (CTP regime)FCA, PRA and the Bank of England

• Firms' supplier records

  EU (DORA)Submitted every year
  UK (CTP regime)Annual submission of material supplier records starts on 18 March 2027

Where's the difference? The EU cast a wide net; the UK caught only the four biggest fish and says openly that it wants to stick to a "small number" of providers. But it's clear the list will grow. Parliament's Treasury Committee wants AI providers brought into the regime too.

For those working in both markets: A group licensed in London and Frankfurt will manage two separate records and two separate sets of supervisory expectations for the same supplier. Different format, same logic.

Two desks, two decisions. Make your pick, then see our take.

At most banks DORA started as a compliance project and stayed on the compliance team's desk. We think its real effect will be felt at the product desk. Because now every new feature, every new partner, every new market starts with a DORA question.

It's easy to judge from the outside. So instead of a verdict, we'll leave a few questions:

• When you look at your register, do you see only a list of suppliers, or also where your product roadmap is going to get stuck?
• When you pick a new partner, do you talk about the DORA clauses in the first meeting, or find out about them at the contract table?
• Does your next feature count as a "critical or important function"? Who decides that, and when?
• Would your exit plan for services you get from within the group actually work, or does it only exist on paper?
• Does choosing among DORA ready partners mean giving up the experience your customers want? It shouldn't.

As people who built two banks from scratch and took products live in both Germany and Türkiye, here's what we've seen: however heavy the rule, the team that builds it into the design from day one ends up moving fastest. It's possible to treat DORA not as a checklist bolted on later, but as the first step in choosing partners and shaping the product flow.

If choosing the right partner for a new digital product, or setting up a launch flow that works with DORA, is on your desk, New Product Line and The Right Bank Partner exist for exactly that.