{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/duty-objects",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/duty-objects)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-11",
    "fingerprint": "ewai:eu:e68427",
    "proof": "sha256:504175c2bd8d1e7345fb12a500dae3ff23e4e558cdb4014901baf14b41814425",
    "jurisdiction": "eu",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "enterprise_question": "What applies to us and what must we do?",
  "domain": "dora",
  "label": "DORA",
  "question": "What must a financial entity do on ICT risk?",
  "acts": [
    "eu:dora"
  ],
  "count": 9,
  "with_deadline": 1,
  "with_risk": 9,
  "reviewed_actions": 2,
  "objects": [
    {
      "id": "duty:eu:dora-art-5-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "5",
      "obligation": "The management body defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for it.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 5"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-5-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Approved policy or plan"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "The management body defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for it."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:6d6c9af954c08b45e4b2c7d2c5ff527afd21bec07917b61b8dc12a66a99d61ba",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (IT and security).",
          "Carry out the duty: The management body defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for it.",
          "Document: Approved policy or plan.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 5 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-5-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-6-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "6",
      "obligation": "Maintain a sound, comprehensive and documented ICT risk management framework.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 6"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-6-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Approved policy or plan"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Maintain a sound, comprehensive and documented ICT risk management framework."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:b3f1a77e87536edcec3204e1760abc1fb6880d1a38b3cb940affc6b91121bc4d",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (IT and security).",
          "Carry out the duty: Maintain a sound, comprehensive and documented ICT risk management framework.",
          "Document: Approved policy or plan.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 6 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-6-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-11-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "11",
      "obligation": "Put in place an ICT business continuity policy with response and recovery plans.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 11"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-11-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Approved policy or plan"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Put in place an ICT business continuity policy with response and recovery plans."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:33d787a4346ce0d1fc78be749367069b6cbde71003bae8ee06be3f9352fef3dd",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (IT and security).",
          "Carry out the duty: Put in place an ICT business continuity policy with response and recovery plans.",
          "Document: Approved policy or plan.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 11 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-11-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-17-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "17",
      "obligation": "Define and implement an ICT-related incident management process.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 17"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-17-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Dated internal record of the action"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Define and implement an ICT-related incident management process."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:3ae0bbbe0142b769edcefa5fd6ac3cd1a0e35d542c47a94907082012a565a477",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (IT and security).",
          "Carry out the duty: Define and implement an ICT-related incident management process.",
          "Document: Dated internal record of the action.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 17 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-17-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-19-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "19",
      "obligation": "Report major ICT-related incidents to the competent authority.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "24 hours",
        "note": "Initial notification within 4 hours of classification and no later than 24 hours after awareness; intermediate report within 72 hours; final report within one month.",
        "recipient": "Competent authority",
        "applies_from": "2025-01-17"
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 19"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-19-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Copy of notification with timestamp"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Classify the incident under Art. 18 and the regulatory technical standards.",
          "Submit initial notification, intermediate report and final report to the competent authority.",
          "Inform clients without undue delay where the incident affects their financial interests.",
          "Voluntarily notify significant cyber threats where relevant."
        ],
        "status": "reviewed_action_kit"
      },
      "hash": "sha256:5a76aab04b26f98b7d5933e20857633d59be8b4b8589befded6c616dfcb126ac",
      "what_to_do": {
        "timing": {
          "kind": "deadline",
          "text": "24 hours"
        },
        "steps": [
          "Classify the incident under Art. 18 and the regulatory technical standards.",
          "Submit initial notification, intermediate report and final report to the competent authority.",
          "Inform clients without undue delay where the incident affects their financial interests.",
          "Voluntarily notify significant cyber threats where relevant."
        ],
        "steps_status": "reviewed_action_kit",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-19-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-24-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "24",
      "obligation": "Establish a digital operational resilience testing programme.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "Legal and compliance"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 24"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-24-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Dated internal record of the action"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Establish a digital operational resilience testing programme."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:fcd2617caea497f05eac6975cf687718785924a5b01bbea47649c0875575d978",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (Legal and compliance).",
          "Carry out the duty: Establish a digital operational resilience testing programme.",
          "Document: Dated internal record of the action.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 24 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-24-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-26-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "26",
      "obligation": "Carry out threat-led penetration testing where identified by the competent authority.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "Legal and compliance"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 26"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-26-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Dated internal record of the action"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Carry out threat-led penetration testing where identified by the competent authority."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:3135dd39a6fe6ae03b9ab792f1f191207aa37327cfa4d09a3dda2b06c464b98b",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (Legal and compliance).",
          "Carry out the duty: Carry out threat-led penetration testing where identified by the competent authority.",
          "Document: Dated internal record of the action.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 26 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-26-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-28-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "28",
      "obligation": "Manage ICT third-party risk and keep a register of information on all ICT service contracts.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": null
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 28"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-28-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Dated record or log entry"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Manage ICT third-party risk and keep a register of information on all ICT service contracts."
        ],
        "status": "derived_from_duty"
      },
      "hash": "sha256:44a8594440f1bb675a2b8091a53923859ff9a3ac498a3e812bf6cc38ba15f11d",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Assign responsibility: financial-entity (IT and security).",
          "Carry out the duty: Manage ICT third-party risk and keep a register of information on all ICT service contracts.",
          "Document: Dated record or log entry.",
          "Check the wording of DORA: Regulation (EU) 2022/2554 28 before deciding."
        ],
        "steps_status": "derived_from_provision",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline",
        "reviewed_action_kit"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-28-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    },
    {
      "id": "duty:eu:dora-art-30-financial-entity",
      "schema_version": 1,
      "domain": "dora",
      "jurisdiction": "eu",
      "act": "dora",
      "provision": "30",
      "obligation": "Include the key contractual provisions in contracts with ICT third-party service providers.",
      "responsible_role": {
        "legal_role": "financial-entity",
        "owner_function": "IT and security"
      },
      "deadline": {
        "value": "not_in_register",
        "note": null,
        "recipient": "internal",
        "applies_from": "2025-01-17"
      },
      "exceptions": [
        {
          "provision": "DORA art. 16",
          "condition": "Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.",
          "effect": "reduced",
          "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"
        }
      ],
      "risk": {
        "level": "medium",
        "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
        "max_amount": null,
        "max_turnover_pct": 1,
        "sanctions": [
          {
            "id": "sanction:eu:dora-art-50",
            "authority": "Competent authority (Article 46)"
          },
          {
            "id": "sanction:eu:dora-art-35-6",
            "authority": "Lead Overseer (ESA)"
          }
        ]
      },
      "evidence_chain": [
        {
          "step": 1,
          "kind": "primary_source",
          "ref": "DORA: Regulation (EU) 2022/2554",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
        },
        {
          "step": 2,
          "kind": "provision",
          "ref": "dora 30"
        },
        {
          "step": 3,
          "kind": "obligation",
          "ref": "obligation:eu:dora-art-30-financial-entity",
          "method": "Paraphrased from the provision text"
        },
        {
          "step": 4,
          "kind": "evidence_to_keep",
          "ref": "Dated record or log entry"
        }
      ],
      "source": {
        "title": "DORA: Regulation (EU) 2022/2554",
        "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "recommended_action": {
        "do": [
          "Set out rights and obligations in a written contract, including the items in Art. 30(2).",
          "For critical or important functions, also include service levels, notice periods, exit strategies, full access and audit rights and termination rights (Art. 30(3)).",
          "Record the contract in the register of information (Art. 28(3))."
        ],
        "status": "reviewed_action_kit"
      },
      "hash": "sha256:85b49fee16dd24117ce81a0a191ade1011dc93f25763c29e2b41bed3f5d38d30",
      "what_to_do": {
        "timing": {
          "kind": "ongoing",
          "text": "Applies on an ongoing basis while the conditions in the provision are met."
        },
        "steps": [
          "Set out rights and obligations in a written contract, including the items in Art. 30(2).",
          "For critical or important functions, also include service levels, notice periods, exit strategies, full access and audit rights and termination rights (Art. 30(3)).",
          "Record the contract in the register of information (Art. 28(3))."
        ],
        "steps_status": "reviewed_action_kit",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
      },
      "gaps": [
        "statutory_deadline"
      ],
      "links": {
        "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora",
        "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora",
        "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora",
        "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-30-financial-entity"
      },
      "read_at": "2026-08-31",
      "source_label": "Source: NovaCopilot"
    }
  ],
  "source": "NovaCopilot",
  "hash": "sha256:504175c2bd8d1e7345fb12a500dae3ff23e4e558cdb4014901baf14b41814425",
  "version": "legal-2026-10-11",
  "expires": "2026-10-13T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-11+legal-2026-10-11+2026-10-11T20:37:51",
    "content_hash": "sha256:504175c2bd8d1e7345fb12a500dae3ff23e4e558cdb4014901baf14b41814425",
    "revalidate_after": "2026-10-12T01:29:32.443Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/duty-objects",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}