DORA: Regulation (EU) 2022/2554
CELEX 32022R2554 · Read 2026-08-12
Digital operational resilience for financial entities: ICT risk management, incident reporting and oversight of critical third-party providers.
Current version
- Last verified
- 2026-08-31
- Source
- CELEX 32022R2554
- Consolidated version
- 2023-01-16(derived)
- Amendments
- No amending acts registered since entry into force
- Status
- In force · updated · consolidated
Chain of evidence
- Retrieved from EUR-Lex
- Verified against the consolidated version
- Automatic check on every EU amendment
This act is updated automatically when the EU publishes a new version.
Download the record
The same fields as above, for audit and archiving.
Identifier
- CELEX
- 32022R2554
- Identifier
- EU 2022/2554
- Adopted
- 2022-12-14
- In force
- 2023-01-16
- Applies from
- 2025-01-17
- Articles
- 64
Articles
64 articles are read into the register, one address each. Read on 2026-08-18.
Recitals that carry the interpretation
The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.
Skäl 41 · Article 17
Incident reporting: harmonised formats and short deadlines for major ICT incidents.
Skäl 74 · Article 28
Third-party risk: concentration risk among critical ICT providers is monitored at union level.
Guidance and secondary law
Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.
- Technical standard (RTS) · EBA/ESMA/EIOPA2024-01-17RTS on ICT risk management tools, methods, processes and policies (JC 2023-83)
The technical standard that fills Articles 6 and 7: what an ICT risk-management framework must contain.
Article 6, 7
- Technical standard (RTS) · EBA/ESMA/EIOPA2024-01-17RTS/ITS on classification and reporting of major ICT-related incidents (JC 2023-85)
Classification thresholds and reporting formats for major ICT incidents under Articles 17-23.
Article 17, 18, 19, 20, 21, 22, 23
Supervisory bodies
Official source
National instruments
SE Svensk författningssamling, Riksdagen
Not stated in the register · www.riksdagen.se
NO Lovdata
Not stated in the register · lovdata.no
DK Retsinformation
Not stated in the register · www.retsinformation.dk
FI Finlex
Not stated in the register · www.finlex.fi
DE Gesetze im Internet
Not stated in the register · www.gesetze-im-internet.de
UK legislation.gov.uk
Not stated in the register · www.legislation.gov.uk
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | EUR-Lex |
| Publisher | Europeiska unionens publikationsbyrå |
| Last read | 2026-08-31 |
| Interval | Every 30 days |
| Next re-read | 2026-09-30 |
| Status | Re-read scheduled |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-31 | Row read against EUR-Lex | Europeiska unionens publikationsbyrå |
| 2025-01-17 | Date of application under the act | EUR-Lex |
| 2023-01-16 | Entry into force under CELEX 32022R2554 | EUR-Lex |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
CELEX 32022R2554, DORA: Regulation (EU) 2022/2554. NovaCopilot, https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554 (hämtad 2026-10-14, bevis sha256:2e24d9b50b95995c, bygge legal-2026-10-14).
- sha256:
- 2e24d9b50b95995cd3cb6377401c5dddcc6fab7ae839ae5d2c42aab0f12c1a71
- hämtad:
- 2026-10-14
- source_confidence:
- official
- bygge:
- legal-2026-10-14
Official publication. The address points to the authority or court that published the row. Europeiska unionens publikationsbyrå, EUR-Lex.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act