{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-5-6",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/dora-agent/art-5-6)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-14",
    "fingerprint": "ewai:se:d02f0f",
    "proof": "sha256:a80b0a4ff211e379c1df2731b048a1b9030305db61b8ae6a9f082739ddd671c3",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "agent_id": "agent:eu:dora:agent-dora-art-5-6",
  "agent_version": "1",
  "schema_version": "1",
  "graph_version": "2026-10-10.1",
  "section": "DORA art. 5 och 6, förordning (EU) 2022/2554",
  "title": "DORA Art. 5–6 ICT Governance and Risk Framework Agent",
  "question": "What must our management body and ICT risk framework do under DORA?",
  "applies_from": "2025-01-17",
  "requirements": [
    {
      "id": "requirement:eu:dora:art-5-1",
      "provision": "Art. 5(1)",
      "title": "Internal governance and control framework for ICT risk",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-5-2",
      "provision": "Art. 5(2)",
      "title": "Management body defines, approves and oversees the ICT risk framework",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-5-2-a",
      "provision": "Art. 5(2)(a)",
      "title": "Ultimate responsibility for ICT risk",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-5-2-g",
      "provision": "Art. 5(2)(g)",
      "title": "Budget for digital operational resilience",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-5-4",
      "provision": "Art. 5(4)",
      "title": "Management body ICT knowledge and training",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-6-1",
      "provision": "Art. 6(1)",
      "title": "Sound, comprehensive and well-documented ICT risk framework",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-6-4",
      "provision": "Art. 6(4)",
      "title": "Independent ICT risk control function",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-6-5",
      "provision": "Art. 6(5)",
      "title": "Annual review of the ICT risk framework",
      "verbatim": true
    }
  ],
  "deadlines": {
    "framework_review": {
      "at_least": "once a year",
      "provision": "Art. 6(5)"
    }
  },
  "sanctions": [
    {
      "key": "art-50-administrative",
      "provision": "Art. 50(3)–(4)",
      "authority": "National competent authorities (Art. 46)",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "amount": "set_by_member_state",
      "measures": [
        "cease-and-desist order",
        "cessation of practice",
        "measures including of pecuniary nature",
        "public notice naming the person and breach"
      ],
      "id": "sanction:eu:dora:art-50-administrative"
    },
    {
      "key": "art-35-periodic-penalty",
      "provision": "Art. 35(6)–(8)",
      "authority": "Lead Overseer (EBA, ESMA or EIOPA)",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "applies_to": "critical ICT third-party service providers",
      "max_daily_share_of_worldwide_turnover": 0.01,
      "max_months": 6,
      "id": "sanction:eu:dora:art-35-periodic-penalty"
    }
  ],
  "cases": [],
  "counts": {
    "requirements": 8,
    "controls": 4,
    "cases": 0,
    "scope_entity_types": 20
  },
  "deterministic": true,
  "agent_hash": "c52a775085c53d868f58648b0981fd338372db12fd3f6118c0c5c3a83335387d",
  "hash": "sha256:a80b0a4ff211e379c1df2731b048a1b9030305db61b8ae6a9f082739ddd671c3",
  "case_note": "No DORA sanction decision with an official public source is in the register yet (DORA applies from 2025-01-17); status not_in_register.",
  "scope": {
    "entities": [
      "credit institutions",
      "payment institutions",
      "account information service providers",
      "electronic money institutions",
      "investment firms",
      "crypto-asset service providers and issuers of asset-referenced tokens",
      "central securities depositories",
      "central counterparties",
      "trading venues",
      "trade repositories",
      "managers of alternative investment funds",
      "management companies",
      "data reporting service providers",
      "insurance and reinsurance undertakings",
      "insurance and reinsurance intermediaries",
      "institutions for occupational retirement provision",
      "credit rating agencies",
      "administrators of critical benchmarks",
      "crowdfunding service providers",
      "securitisation repositories"
    ],
    "provision": "Art. 2(1)(a)–(t)",
    "note": "Gambling and betting operators are not financial entities under DORA unless they also hold one of these licences."
  },
  "endpoints": {
    "self": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-5-6",
    "node": "https://legal.exploreworldai.com/api/public/v1/node/agent/agent%3Aeu%3Adora%3Aagent-dora-art-5-6",
    "page": "https://legal.exploreworldai.com/agent/dora/art-5-6",
    "nodes": "https://legal.exploreworldai.com/graf/dora",
    "regulation": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
  },
  "not_covered": {
    "other_articles": "Art. 24–27 resilience testing and Art. 31–44 oversight of critical ICT providers are not_in_register for these agents."
  },
  "provenance": {
    "primary_source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
    "reporting_deadlines": "https://eur-lex.europa.eu/eli/reg_del/2025/301/oj",
    "read_at": "2026-10-10",
    "method": "verbatim EUR-Lex text where verbatim = true; editorial control and cross-framework mapping (unreviewed)"
  },
  "source": "Source: NovaCopilot",
  "version": "legal-2026-10-14",
  "expires": "2026-10-16T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-14+legal-2026-10-14+2026-10-14T19:52:40",
    "content_hash": "sha256:a80b0a4ff211e379c1df2731b048a1b9030305db61b8ae6a9f082739ddd671c3",
    "revalidate_after": "2026-10-15T04:55:37.342Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-5-6",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "control_mappings": 4
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}