Compliance Colleague · Standards · EU & UK

DORA (Regulation (EU) 2022/2554): cited answers and gap reviews

An AI compliance assistant for EU financial entities and their ICT providers · updated 2026-10-03

The Digital Operational Resilience Act sets ICT risk, incident, testing and third-party rules for EU financial entities. Compliance Colleague covers the regulation and its technical standards, including the Register of Information and contract terms for ICT providers.

Try it on your own DORA work: one document review or two questions, free for 30 days, no card required. Start free →

What it covers

ICT risk management framework (Article 6)
ICT incident classification and reporting (Article 17 onwards)
Threat-led penetration testing (Article 26)
ICT third-party risk, contract terms (Article 30) and the Register of Information
Oversight of critical ICT third-party providers

Questions you can ask

“What must our contracts with ICT providers contain under Article 30?”
“How do we classify a major ICT-related incident?”
“Are we in scope of the simplified ICT risk framework?”

Every answer cites the DORA requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

An ICT provider contract checked against Article 30
A Register of Information (Excel) checked for missing fields
An ICT risk framework checked against Article 6

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk DORA to other standards

With DORA in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

Example answers

What are DORA's deadlines for the initial notification and intermediate report of a major ICT incident?

What it’s built from

Compliance Colleague carries the official text and checks its answers against it: Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) (Publications Office of the European Union (EUR-Lex)).

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More EU & UK standards

GDPR · EU AI Act · NIS2 · EU Cyber Resilience Act · CSRD

Compliance Colleague covers 30+ security, privacy and AI governance standards. It reviews policies, spreadsheets and diagrams and answers questions with the clause cited; your judgment and sign-off stay with you. Try it free, no card required →

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.