{
  "object_type": "agent_pack",
  "schema_version": 1,
  "id": "agent-pack:eu:dora",
  "act": "dora",
  "count": 12,
  "pack_hash": "1b0d1b5fa2523de2522caa59743c8c48940328fe8f43e70d7fd0017694b81763",
  "usage": "Use each card directly in an answer: applies, risk, do, deadline, authority, source. Follow next_questions for the user's likely follow-up. Missing facts are not_in_register. Not legal advice.",
  "cards": [
    {
      "id": "card:eu:article:dora--art-5",
      "applies": [
        "financial-entity: The management body defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for it."
      ],
      "risk": "high",
      "do": [
        "The management body defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for it."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "7705c715ef87196509f369ee163c95d415770965b6b88e83d3dde09176e3eab4",
      "next": [
        "obligation:eu:dora-art-5-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 11 AMLR require?",
          "card": "card:eu:article:amlr--art-11"
        },
        {
          "q": "What does Article 9 AMLR require?",
          "card": "card:eu:article:amlr--art-9"
        },
        {
          "q": "What does Article 11 CSDDD require?",
          "card": "card:eu:article:csddd--art-11"
        },
        {
          "q": "What does Article 14 CSDDD require?",
          "card": "card:eu:article:csddd--art-14"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-6",
      "applies": [
        "financial-entity: Maintain a sound, comprehensive and documented ICT risk management framework."
      ],
      "risk": "high",
      "do": [
        "Maintain a sound, comprehensive and documented ICT risk management framework."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "d83d15bea023bfd8d837bb3d787c4b9d58118d68d0da01ff9ee1ba7089b8d01c",
      "next": [
        "obligation:eu:dora-art-6-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 11 AMLR require?",
          "card": "card:eu:article:amlr--art-11"
        },
        {
          "q": "What does Article 9 AMLR require?",
          "card": "card:eu:article:amlr--art-9"
        },
        {
          "q": "What does Article 11 CSDDD require?",
          "card": "card:eu:article:csddd--art-11"
        },
        {
          "q": "What does Article 14 CSDDD require?",
          "card": "card:eu:article:csddd--art-14"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-8",
      "applies": [
        "financial-entity: Identify, classify and document all ICT-supported business functions, information assets and ICT assets, and review the classification at least yearly."
      ],
      "risk": "high",
      "do": [
        "Identify, classify and document all ICT-supported business functions, information assets and ICT assets, and review the classification at least yearly."
      ],
      "deadline": "Review at least yearly and on every major change in network or infrastructure.",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "5318d4076f74b9520a5e1e60ffa3e421565fbc43780b402c1849c68e28db7b5a",
      "next": [
        "obligation:eu:dora-art-8-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 27 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-27"
        },
        {
          "q": "What does Article 15 CSDDD require?",
          "card": "card:eu:article:csddd--art-15"
        },
        {
          "q": "What does Article 8 CSDDD require?",
          "card": "card:eu:article:csddd--art-8"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 12 DORA require?",
          "card": "card:eu:article:dora--art-12"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-11",
      "applies": [
        "financial-entity: Put in place an ICT business continuity policy with response and recovery plans."
      ],
      "risk": "high",
      "do": [
        "Put in place an ICT business continuity policy with response and recovery plans."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "ff51f4a7f5f0ffc82729499bb78e8d8a427410e259cb4a627462206faf00d5ed",
      "next": [
        "obligation:eu:dora-art-11-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 11 AMLR require?",
          "card": "card:eu:article:amlr--art-11"
        },
        {
          "q": "What does Article 9 AMLR require?",
          "card": "card:eu:article:amlr--art-9"
        },
        {
          "q": "What does Article 11 CSDDD require?",
          "card": "card:eu:article:csddd--art-11"
        },
        {
          "q": "What does Article 14 CSDDD require?",
          "card": "card:eu:article:csddd--art-14"
        },
        {
          "q": "What does Article 12 DORA require?",
          "card": "card:eu:article:dora--art-12"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-12",
      "applies": [
        "financial-entity: Set and document backup, restoration and recovery policies, with backup systems physically and logically segregated from the source systems, and test them periodically."
      ],
      "risk": "high",
      "do": [
        "Set and document backup, restoration and recovery policies, with backup systems physically and logically segregated from the source systems, and test them periodically."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "6247279ada22a2d0616902a48edc32b9f6d3f038d629847c8acb4a597c52af2c",
      "next": [
        "obligation:eu:dora-art-12-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 10 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-10"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 16 DORA require?",
          "card": "card:eu:article:dora--art-16"
        },
        {
          "q": "What does Article 17 DORA require?",
          "card": "card:eu:article:dora--art-17"
        },
        {
          "q": "What does Article 19 DORA require?",
          "card": "card:eu:article:dora--art-19"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-16",
      "applies": [
        "financial-entity: Small and non-interconnected entities: put in place and maintain a sound and documented simplified ICT risk management framework."
      ],
      "risk": "high",
      "do": [
        "Small and non-interconnected entities: put in place and maintain a sound and documented simplified ICT risk management framework."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "60791500e97502ce10d8510e433b06356204546b49ed341cc733e70315089301",
      "next": [
        "obligation:eu:dora-art-16-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 11 AMLR require?",
          "card": "card:eu:article:amlr--art-11"
        },
        {
          "q": "What does Article 9 AMLR require?",
          "card": "card:eu:article:amlr--art-9"
        },
        {
          "q": "What does Article 11 CSDDD require?",
          "card": "card:eu:article:csddd--art-11"
        },
        {
          "q": "What does Article 14 CSDDD require?",
          "card": "card:eu:article:csddd--art-14"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-17",
      "applies": [
        "financial-entity: Define and implement an ICT-related incident management process."
      ],
      "risk": "high",
      "do": [
        "Define and implement an ICT-related incident management process."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "4d56a1a4a56e11f77be3069a762a98c2ed1e77514ff83f33283361bf63172847",
      "next": [
        "obligation:eu:dora-art-17-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 16 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-16"
        },
        {
          "q": "What does Article 17 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-17"
        },
        {
          "q": "What does Article 26 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-26"
        },
        {
          "q": "What does Article 72 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-72"
        },
        {
          "q": "What does Article 9 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-9"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-19",
      "applies": [
        "financial-entity: Report major ICT-related incidents to the competent authority."
      ],
      "risk": "high",
      "do": [
        "Report major ICT-related incidents to the competent authority."
      ],
      "deadline": "Initial notification within 4 hours of classification and no later than 24 hours after awareness; intermediate report within 72 hours; final report within one month.",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "fbed26089db422d7f1e8eff5974e008454212422b67dfaaaa80a3c86aae26daf",
      "next": [
        "obligation:eu:dora-art-19-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 73 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-73"
        },
        {
          "q": "What does Article 69 AMLR require?",
          "card": "card:eu:article:amlr--art-69"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 12 DORA require?",
          "card": "card:eu:article:dora--art-12"
        },
        {
          "q": "What does Article 16 DORA require?",
          "card": "card:eu:article:dora--art-16"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-24",
      "applies": [
        "financial-entity: Establish a digital operational resilience testing programme."
      ],
      "risk": "high",
      "do": [
        "Establish a digital operational resilience testing programme."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "750ea878a5f6f458b82e09206da3b89bdb4dbb233b1dcc2184148cab7a239e51",
      "next": [
        "obligation:eu:dora-art-24-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 10 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-10"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 12 DORA require?",
          "card": "card:eu:article:dora--art-12"
        },
        {
          "q": "What does Article 16 DORA require?",
          "card": "card:eu:article:dora--art-16"
        },
        {
          "q": "What does Article 17 DORA require?",
          "card": "card:eu:article:dora--art-17"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-26",
      "applies": [
        "financial-entity: Carry out threat-led penetration testing where identified by the competent authority."
      ],
      "risk": "high",
      "do": [
        "Carry out threat-led penetration testing where identified by the competent authority."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "5c5bf03513cef988a8031a0b380cade90c4d2f34a68fac2b583a7a38250bc8e7",
      "next": [
        "obligation:eu:dora-art-26-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 10 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-10"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 12 DORA require?",
          "card": "card:eu:article:dora--art-12"
        },
        {
          "q": "What does Article 16 DORA require?",
          "card": "card:eu:article:dora--art-16"
        },
        {
          "q": "What does Article 17 DORA require?",
          "card": "card:eu:article:dora--art-17"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-28",
      "applies": [
        "financial-entity: Manage ICT third-party risk and keep a register of information on all ICT service contracts."
      ],
      "risk": "high",
      "do": [
        "Manage ICT third-party risk and keep a register of information on all ICT service contracts."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "032d0386636c9e31d7038be263ffd8516257162923eb549c4afd21cdf0162d2d",
      "next": [
        "obligation:eu:dora-art-28-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 11 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-11"
        },
        {
          "q": "What does Article 12 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-12"
        },
        {
          "q": "What does Article 53 AI-ACT require?",
          "card": "card:eu:article:ai-act--art-53"
        },
        {
          "q": "What does Article 10 AMLR require?",
          "card": "card:eu:article:amlr--art-10"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        }
      ],
      "attribution": "Source: NovaCopilot"
    },
    {
      "id": "card:eu:article:dora--art-30",
      "applies": [
        "financial-entity: Include the key contractual provisions in contracts with ICT third-party service providers."
      ],
      "risk": "high",
      "do": [
        "Include the key contractual provisions in contracts with ICT third-party service providers."
      ],
      "deadline": "not_in_register",
      "authority": [
        "Competent authority (Article 46)",
        "Lead Overseer (ESA)"
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "core_hash": "4a0e766ef02a38f289498b77eb7eb33ec553a5ee11b27e3b115a050ef362b7ad",
      "next": [
        "obligation:eu:dora-art-30-financial-entity",
        "sanction:eu:dora-art-35-6",
        "sanction:eu:dora-art-50",
        "authority:eu:competent-authority-article-46",
        "authority:eu:lead-overseer-esa"
      ],
      "next_questions": [
        {
          "q": "What does Article 13 ACCESSIBILITY require?",
          "card": "card:eu:article:accessibility--art-13"
        },
        {
          "q": "What does Article 11 DORA require?",
          "card": "card:eu:article:dora--art-11"
        },
        {
          "q": "What does Article 12 DORA require?",
          "card": "card:eu:article:dora--art-12"
        },
        {
          "q": "What does Article 16 DORA require?",
          "card": "card:eu:article:dora--art-16"
        },
        {
          "q": "What does Article 17 DORA require?",
          "card": "card:eu:article:dora--art-17"
        }
      ],
      "attribution": "Source: NovaCopilot"
    }
  ],
  "index": "/api/public/v1/agent-pack",
  "concept": "/api/public/v1/agent",
  "attribution": "Source: NovaCopilot",
  "access_class": "decision",
  "access_view": "public"
}