{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:dora-art-26-financial-entity","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:dora-art-26-financial-entity)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-03","fingerprint":"ewai:eu:35d8a8","proof":"sha256:3a294b4587524657cf846cb4d7c5e10fdc75c2693c5f83dc579df0b48b2498d8","jurisdiction":"eu","lang":"en"},"brand_source":"Source: NovaCopilot","status":"ok","id":"duty:eu:dora-art-26-financial-entity","schema_version":1,"domain":"dora","jurisdiction":"eu","act":"dora","provision":"26","obligation":"Carry out threat-led penetration testing where identified by the competent authority.","responsible_role":{"legal_role":"financial-entity","owner_function":"Legal and compliance"},"deadline":{"value":"not_in_register","note":null,"recipient":"internal","applies_from":null},"exceptions":[{"provision":"DORA art. 16","condition":"Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.","effect":"reduced","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"}],"risk":{"level":"medium","basis":"Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low","max_amount":null,"max_turnover_pct":1,"sanctions":[{"id":"sanction:eu:dora-art-50","authority":"Competent authority (Article 46)"},{"id":"sanction:eu:dora-art-35-6","authority":"Lead Overseer (ESA)"}]},"evidence_chain":[{"step":1,"kind":"primary_source","ref":"DORA: Regulation (EU) 2022/2554","url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj"},{"step":2,"kind":"provision","ref":"dora 26"},{"step":3,"kind":"obligation","ref":"obligation:eu:dora-art-26-financial-entity","method":"Paraphrased from the provision text"},{"step":4,"kind":"evidence_to_keep","ref":"Dated internal record of the action"}],"source":{"title":"DORA: Regulation (EU) 2022/2554","url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj"},"recommended_action":{"do":["Carry out threat-led penetration testing where identified by the competent authority."],"status":"derived_from_duty"},"hash":"sha256:3a294b4587524657cf846cb4d7c5e10fdc75c2693c5f83dc579df0b48b2498d8","what_to_do":{"timing":{"kind":"ongoing","text":"Applies on an ongoing basis while the conditions in the provision are met."},"steps":["Assign responsibility: financial-entity (Legal and compliance).","Carry out the duty: Carry out threat-led penetration testing where identified by the competent authority.","Document: Dated internal record of the action.","Check the wording of DORA: Regulation (EU) 2022/2554 26 before deciding."],"steps_status":"derived_from_provision","source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj"},"gaps":["statutory_deadline","reviewed_action_kit"],"links":{"obligation_graph":"https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora","provenance_graph":"https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora","action_graph":"https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora","self":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-26-financial-entity"},"read_at":"2026-08-31","source_label":"Source: NovaCopilot","version":"legal-2026-11-03","expires":"2026-11-06T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-03+legal-2026-11-03+2026-11-03T08:46:54","content_hash":"sha256:3a294b4587524657cf846cb4d7c5e10fdc75c2693c5f83dc579df0b48b2498d8","revalidate_after":"2026-11-03T11:19:18.195Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:dora-art-26-financial-entity","disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","freshness":{"freshness_class":"live","as_of":"2026-11-03T10:19:18.195Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-26-financial-entity","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1432}}