Compliance tools · Cybersecurity and data protection

DORA compliance tool

Regulation (EU) 2022/2554 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your DORA documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

DORA is Regulation (EU) 2022/2554, a binding instrument in the European Union. ICT risk management and operational resilience for financial entities.

The free assessment screens for DORA when a business provides financial services or is an obliged financial entity.

Sectors this instrument reaches: credit institutions; payment institutions; electronic money institutions; account information service providers; investment firms; crypto-asset service providers; central securities depositories; central counterparties; trading venues; trade repositories; fund managers; insurance and reinsurance undertakings; insurance and reinsurance intermediaries; occupational pension institutions; credit rating agencies; critical benchmark administrators; crowdfunding service providers; securitisation repositories; data reporting service providers; ICT third-party service providers to financial entities.

Screen your business against all 116 agent toolkits, free →

• Your exact position under DORA: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that DORA applies to your business, free →

Does DORA apply to my business?

DORA applies to you if you are a financial entity in one of the 21 covered categories, or an ICT third-party service provider serving EU financial entities. The trigger is the activity and sector, not headcount or turnover. It applies from 17 January 2025.

Who does DORA apply to?

It applies to 21 categories of financial entity, including credit institutions, payment institutions, electronic money institutions, account information service providers, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, fund managers, insurers and reinsurance intermediaries, occupational pension institutions, credit rating agencies, critical benchmark administrators, crowdfunding service providers and securitisation repositories. It also applies to ICT third-party service providers.

Does DORA apply to a small business?

There is no general size threshold, but microenterprises employing fewer than 10 persons with annual turnover or balance sheet not exceeding EUR 2 million (Article 3(60)) get a simplified ICT risk management arrangement under Article 16. Insurance, reinsurance and ancillary insurance intermediaries that are microenterprises or SMEs are excluded (Article 2(3)(e)). Trading venues, central counterparties, trade repositories and central securities depositories cannot qualify as microenterprises.

When does DORA apply from, and what are the deadlines?

DORA entered into force on the twentieth day following its publication on 27 December 2022 and applies from 17 January 2025. Major incident reports follow an initial notification, intermediate reports and a final report (Article 19(4)), with time limits set by delegated acts under Article 20. Critical third-country providers must establish an EU subsidiary within 12 months of designation (Article 31(12)).

What does DORA require me to do?

You must run an ICT risk management arrangement across governance, identification, protection, detection, continuity, recovery, learning and communication (Chapter II, Articles 5 to 16). You must manage and report ICT-related incidents (Chapter III, Articles 17 to 23), run digital operational resilience testing including TLPT every three years (Chapter IV, Articles 24 to 27), and manage ICT third-party risk including a register of information (Chapter V, Articles 28 to 44).

What records or documents does DORA require me to keep or produce?

You must keep a register of information on all ICT third-party contractual arrangements and make it available to the competent authority on request (Article 28(3)). You must submit an ICT risk management review report on request (Article 6(5)), and provide TLPT findings, remediation plans and attestation documentation (Article 26(6) and Article 26(7)).

What happens if I do not comply with DORA?

DORA does not set fine amounts itself; Member States must lay down administrative penalties and remedial measures for breaches (Article 50(1)), so scales differ by country. For critical ICT third-party service providers, the Lead Overseer may impose periodic penalty payments of up to 1 per cent of average daily worldwide turnover, imposed daily for no more than six months (Article 35(8)).

How do I start complying with DORA?

The first practical step is to put the management body in charge: it bears ultimate responsibility for managing ICT risk and that responsibility cannot be delegated (Article 5(2)). It must define, approve and oversee the ICT risk management structure, set roles and responsibilities, and approve the digital operational resilience strategy (Article 6(8)).

Which ComplianceSME account includes the DORA toolkit?

The DORA agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive