EU regulatory register · DORA
Article 2Scope
CELEX 32022R2554 · Read on 2026-08-18
Short answer
1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-2 · Short answer as data · Official text
DORA, digital operational resilience in short
Financial entities must manage ICT risk, report major ICT incidents, test resilience and govern ICT providers by contract.
- Who is covered by DORA?
- What does Article 30 require in ICT contracts?
- How fast must an ICT incident be reported?
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:
(a)
credit institutions;
(b)
payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366;
(c)
account information service providers;
(d)
electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC;
(e)
investment firms;
(f)
crypto-asset service providers as authorised under a Regulation of the European Parliament and of the Council on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (‘the Regulation on markets in crypto-assets’) and issuers of asset-referenced tokens;
(g)
The article continues in the official text.
Follow-up questions
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit