DORA for Non-EU Vendors: What US/UK SaaS Companies Need to Know

If you're an IT or risk leader at a mid-market bank, insurer, asset manager, or fintech operating in the EU, you already know DORA compliance isn't optional. What's harder to pin down is the number: the real DORA compliance cost your firm should be planning for in 2026, and where that money actually goes. This guide breaks down the budget line by line — staffing, testing, tooling, and audit — using published survey data and regulatory sources, so you can build a defensible number instead of guessing. The Digital Operational Resilience Act has applied in full since 17 January 2025, and it now touches roughly 22,000 financial entities across the EU — banks, insurers, investment firms, payment institutions, crypto-asset service providers, and the ICT vendors that serve them. For large banking groups with existing operational-resilience programs, DORA was an extension of work already underway. For mid-market firms — the €1–30B asset banks, regional insurers, and growth-stage fintechs without a 200-person compliance department — it's a much heavier lift relative to headcount and budget, which is exactly why getting the cost estimate right matters. A rushed compliance audit tends to cost more, twice, than a properly scoped one. What Drives DORA Compliance Cost for Mid-Market Firms DORA compliance cost isn't one line item — it's the sum of five separate obligations, and mid-market firms usually underestimate three of them: the Register of Information, resilience testing, and third-party contract remediation. The main cost drivers are: Governance and framework build-out — documenting an ICT risk management framework, board-level reporting lines, and policy ownership where none existed before. Register of Information — a structured inventory of every ICT third-party contract, mapped to critical or important functions. Deloitte's 2025 survey found this was the single most challenging requirement for 46% of financial entities, largely because the data lives in five different systems and nobody owns it end to end. Digital operational resilience testing — including Threat-Led Penetration Testing (TLPT) for firms designated as systemically relevant, run on a roughly three-year cycle. Third-party risk management — renegotiating cloud, SaaS, and outsourcing contracts to include audit rights, exit clauses, and subcontracting visibility. Incident detection and reporting — tooling and process to classify and report major ICT incidents within DORA's tight regulatory timelines. Before you can price any of this, it helps to have someone independently map your current state against the regulation — which is exactly what our compliance audit services are built to do: a gap assessment that tells you which of these five cost drivers are already partly covered and which need funding from zero. DORA Compliance Cost Breakdown by Category The table below reflects typical ranges for a mid-market financial entity (roughly 100–1,500 employees, a single EU regulated entity, moderate ICT complexity). Treat it as a planning baseline, not a quote — actual DORA compliance cost varies with the number of critical third-party providers you have, whether you're in scope for TLPT, and how mature your existing ICT risk framework already is. Cost categoryOne-time / setup costAnnual ongoing costICT risk management framework & governance€80K – €250K€60K – €150KRegister of Information & third-party contract remediation€100K – €300K€50K – €120KDigital resilience testing (incl. TLPT where in scope)€200K – €620K per test cycleAmortized: €70K – €200KIncident detection, classification & reporting tooling€60K – €200K€40K – €100KDedicated compliance & ICT risk staffing (FTEs)Recruiting/onboarding: €20K – €60K€400K – €900K (4–7 FTEs)External audit, legal review & advisory—€80K – €250KDORA Compliance Cost Breakdown by Category How Much Do Mid-Market Financial Firms Actually Spend? Survey data lines up with the table above. In Deloitte's 2025 DORA European Survey of CISOs, CROs, and DORA programme managers across 28 countries, 96% of financial institutions had estimated their compliance costs, and most landed between €2 million and €5 million in cumulative spend. That figure spans firms of very different sizes, but two data points from the same survey are directly useful for mid-market budgeting: nearly 40% of organizations now dedicate more than seven full-time employees solely to DORA compliance work, and 70% expect the regulation to permanently raise their run-rate technology and technology-control costs — this isn't a one-time project cost, it's a new operating baseline. Resilience testing is where estimates diverge most. For firms in scope for Threat-Led Penetration Testing, a full TLPT cycle typically runs €200K–€620K, covering threat intelligence profiling (€50K–€150K), red-team execution over an 8–12 week window (€120K– €320K), and white-team coordination, legal review, and regulatory liaison (€30K– €80K) — excluding remediation of whatever the test finds. Because TLPT runs on a roughly three-year cycle under the framework overseen by the European Banking Authority's joint regulatory technical standards on TLPT, most firms amortize it into an annual budget line rather than treating it as a single spike. DORA's Five Pillars and Their Cost Impact DORA, formally Regulation (EU) 2022/2554, is built around five requirements, and each one carries a different cost profile for a mid-market firm. Pillars 3 and 4 — resilience testing and third-party risk management — consistently absorb the largest share of a mid-market firm's DORA compliance cost, because both require work your team likely hasn't done before at this level of rigor. Pillar 5, information sharing on cyber threats, is comparatively cheap: it's mostly a legal and process exercise to join recognized information-sharing arrangements, overseen at the EU level by the European Supervisory Authorities (EIOPA, ESMA, and the EBA jointly). Hidden Costs Mid-Market Firms Often Miss The categories above cover the obvious spend. The costs that blow up a DORA budget mid-year tend to be the ones nobody scoped up front: Cloud contract renegotiation friction. Adding DORA-mandated audit rights, exit provisions, and subcontracting visibility to existing hyperscaler and SaaS contracts takes legal cycles you can't fully control — plan for 3–6 months of back-and-forth per major vendor, not weeks. Kubernetes and microservices sprawl. Firms running containerized, multi-cloud architectures often find their Register of Information is incomplete because nobody has a live map of every service dependency — a gap that shows up fast once you start securing Kubernetes environments to DORA's standard. Remediation after testing. TLPT and vulnerability findings routinely trigger infrastructure or process changes that weren't in the original budget — industry estimates put critical-finding remediation at €50K–€500K+ on top of the test itself. How to Budget for DORA Compliance Cost: A Practical Framework Rather than budgeting against a single headline number, mid-market firms get more accurate results building the number bottom-up: Run a gap assessment first. Map your current ICT risk framework, contracts, and testing history against DORA's five pillars before pricing anything — this alone typically cuts the eventual budget by 20–30% by identifying what's already partly covered. Separate one-time build costs from run-rate costs. Framework documentation and initial Register of Information build are one-time; staffing, monitoring, and contract management are permanent additions to opex. Price testing on its real cycle. If you're in TLPT scope, amortize the full test cost over three years rather than budgeting it as a single-year spike — and start planning at least 18 months ahead to secure threat-intelligence and red-team provider capacity. Budget contract remediation per critical vendor, not as a lump sum. Each cloud, payments, or data provider contract needs its own legal review cycle; a firm with 15 critical ICT providers should expect a materially longer timeline than one with five. Build in a 15–20% contingency for remediation findings from resilience testing and incident-reporting tooling integration — this is consistently where actual spend exceeds the original estimate. Quick gut-check: if your current DORA budget doesn't include a dedicated line for third-party contract remediation and testing remediation separately from the testing itself, it's probably understated by 15–25%. Cost of Non-Compliance vs. Cost of Compliance It's worth pricing the alternative. DORA leaves administrative penalties for financial entities to national competent authorities, so exact figures vary by member state — but for critical ICT third-party providers (the 19 firms the ESAs designated as critical in November 2025, including major cloud providers), the Lead Overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover for each day of non-compliance, for up to six months. Beyond direct fines, a documented compliance gap can trigger a regulator-mandated contract termination with a critical vendor — which, for a mid-market firm dependent on a single cloud provider, is a far more expensive and disruptive outcome than the original compliance spend would have been. How Gart Solutions Helps Mid-Market Financial Firms Manage DORA Compliance Cost We're a DevOps, cloud, and DevSecOps consultancy that's spent close to two decades helping fintech, SaaS, and regulated infrastructure teams build systems that hold up under audit — not just under load. DORA compliance cost is largely an engineering problem wearing a legal hat: it's about observability, infrastructure-as-code, incident response automation, and third-party dependency mapping done properly, not just paperwork. Compliance & readiness auditsIndependent gap assessment against DORA's five pillars, prioritized by cost and risk. See our IT audit services. DevSecOps & policy as codeAutomated security and compliance checks built into CI/CD, so evidence for auditors is generated continuously — DevSecOps consulting. Observability & incident responseMonitoring and auto-remediation pipelines that meet DORA's incident-reporting timelines — 24/7 IT monitoring. Multi-regulation coverageMany mid-market firms are tackling DORA alongside NIS2 and ISO 27001 in parallel — see how we approach NIS2 compliance requirements. If you're still scoping your DORA budget, a short technical audit is usually the fastest way to turn a rough estimate into a defensible number your board will actually approve. Talk to our compliance audit team. Roman Burdiuzha Co-founder & CTO, Gart Solutions · Cloud Architecture Expert Roman has 15+ years of experience in DevOps and cloud architecture, with prior leadership roles at SoftServe and lifecell Ukraine. He co-founded Gart Solutions, where he leads cloud transformation and infrastructure modernization engagements across Europe and North America. In one recent client engagement, Gart reduced infrastructure waste by 38% through consolidating idle resources and introducing usage-aware automation. Read more on Startup Weekly.

If you run technology or risk for a bank, insurer, investment firm, or payment institution in the EU, the DORA register of information is probably the single compliance artifact keeping your team up at night. It is the inventory of every ICT third-party arrangement your organization relies on, and it is now the first document national regulators pull when they open a supervisory file. Get it wrong — incomplete fields, mismatched contract data, an outdated exit strategy — and it becomes the fastest route to a formal enforcement letter. Get it right, and it becomes a genuine map of your operational risk. This guide explains what the register is, who has to file one, what belongs inside it, the 2026 deadlines, and a practical path to building (and maintaining) one, including where a compliance audit can shortcut the process. What Is the DORA Register of Information? The DORA register of information is a structured, continuously updated record of every contractual arrangement a financial entity has with ICT third-party service providers — cloud vendors, SaaS platforms, data centers, managed security providers, and any subcontractor that supports a critical or important business function. It is mandated under Article 28 of Regulation (EU) 2022/2554, better known as the Digital Operational Resilience Act (DORA). The register exists to solve a specific supervisory problem: regulators previously had no system-wide view of how many banks and insurers were quietly dependent on the same handful of cloud and infrastructure providers. The register of information gives the European Supervisory Authorities (ESAs) and national competent authorities (NCAs) that visibility. It feeds three things directly: 1. Oversight of concentration risk — regulators can see when too much of the financial sector depends on one provider. 2. Designation of Critical ICT Third-Party Providers (CTPPs) — providers deemed systemically important come under direct ESA oversight. 3. Supervisory review of your own ICT risk management — an incomplete or inconsistent register is treated as a governance failure in itself. Who Has to Maintain a DORA Register of Information? DORA's scope is deliberately broad. If your organization holds an EU financial services license, you are almost certainly in scope. That includes: Credit institutions and payment institutions, including e-money institutions and account information service providers. Investment firms, fund managers, and management companies operating under MiFID or the UCITS/AIFMD frameworks. Insurance and reinsurance undertakings, including intermediaries above the small-entity thresholds. Crypto-asset service providers and crowdfunding platforms brought into scope under DORA's extended definitions. Non-EU entities with an EU branch or subsidiary — DORA's extraterritorial reach means a US or UK-headquartered firm with an EU license has the same obligation as a domestic one. Critical ICT third-party providers themselves — including major cloud and hyperscaler platforms designated under the oversight framework — face a parallel but separate reporting regime supervised directly by the ESAs, as described by the European Banking Authority. What's Inside the Register: Templates and Mandatory Fields This is where most teams underestimate the effort. The register of information isn't a single spreadsheet under Commission Implementing Regulation (EU) 2024/2956, it's a set of roughly 15 interconnected templates that must reconcile with each other before submission. Every ICT provider, contract, service line, and subcontractor needs its own record, cross-referenced by consistent identifiers. Template areaWhat it capturesEntity & provider identityLegal Entity Identifier (LEI), country, provider type, and CTPP designation status for every direct ICT providerContractual arrangementsOne record per contract: counterparty, reference date, governing law, notice period, and criticality flagServices & business functionsEach contract broken into individual ICT service lines, mapped to the business function each one supportsSub-outsourcingMaterial subcontractors used by providers that deliver critical or important functionsCost dataActual prior-year spend and estimated current-year cost per arrangement, reported in EURCriticality & exit strategyClassification of critical or important functions (CIF) and the documented exit plan for each oneWhat's Inside the Register: Templates and Mandatory Fields Once populated, the whole package is exported as an xBRL-CSV report — a table-oriented data format with an accompanying metadata file — using the taxonomy published by the ESAs. This is not a format most compliance or risk teams work with natively, which is why register-building is increasingly treated as a joint effort between compliance, procurement, and infrastructure engineering. 2026 Submission Deadlines (and What "Consolidated" Actually Means) Financial entities don't submit straight to the ESAs — they submit to their national competent authority first, which validates, consolidates, and forwards the data. Deadlines vary by country and sector, but they cluster tightly around Q1 2026: Jurisdiction / sectorFinancial entity submission window (2026)Netherlands (DNB)By 20–22 March 2026Germany, France, Belgium, Ireland, Italy, SpainBy 31 March 2026Luxembourg (CSSF, via eDesk)11 February – 31 March 2026Insurance/reinsurance undertakings (e.g., CAA-supervised)By 1 March 2026ESA consolidation deadline (all NCAs)31 March 20262026 Submission Deadlines (and What "Consolidated" Actually Means) According to De Nederlandsche Bank, national competent authorities must forward their fully consolidated registers to the ESAs by 31 March of each calendar year — meaning your own internal submission window will close weeks earlier to give your NCA time to validate the file. Miss the internal deadline and you risk being flagged before the ESA even sees the data. One detail teams frequently miss: the register isn't a once-a-year exercise. Per ESMA's DORA guidance, the underlying register must be kept continuously accurate — the annual submission is simply a snapshot of a system that should already be current. Why the Register of Information Is the First Thing Regulators Check Enforcement moved from "readiness checks" to active supervision in 2026, and Article 28 has become one of the two most frequently examined provisions (alongside Article 5 governance requirements). The financial exposure is real: material non-compliance carries fines of up to 2% of global annual turnover or EUR 10 million, whichever is higher, and individual board members can face personal liability of up to EUR 5,000,000 under national governance provisions. Designated critical providers face their own penalty track, including periodic payments of EUR 500,000 to EUR 5,000,000 per day. In practice, national competent authorities are now cross-checking register of information data automatically against other regulatory filings. An incomplete provider record, a contract missing a termination notice period, or an exit strategy that was never actually tested tends to surface immediately — and has already become the leading cause of first-round supervisory letters. How to Build a DORA Register of Information: A Step-by-Step Approach Whether you're starting from scratch or cleaning up a register assembled under deadline pressure last year, the same sequence applies: Inventory every ICT third-party arrangement — including shadow IT and SaaS tools procured outside central IT, which are the most common gaps. Classify which functions are "critical or important" (CIF) — this classification determines how much detail each contract needs and whether sub-outsourcing has to be tracked. Standardize provider identity data — obtain and validate LEIs for every direct provider; inconsistent identifiers are one of the most common reconciliation failures between templates. Map contracts to the ITS template structure — decompose each contract into individual service lines and link each to the business function it supports. Trace sub-outsourcing chains for any provider supporting a critical function, down to material subcontractors. Document (and actually test) exit strategies for every critical arrangement — a written plan that has never been rehearsed is a common audit finding. Convert to xBRL-CSV and validate against the ESA taxonomy before your NCA's internal deadline, then establish an owner and a quarterly review cadence so the register never goes stale between annual submissions. Most of this work is less about compliance paperwork and more about infrastructure visibility — knowing exactly which cloud accounts, environments, and vendors sit behind each business function. Teams that already have clean infrastructure documentation from an IT audit typically move through steps 1–4 in a fraction of the time. Common mistakes that trigger regulator follow-up Most register problems trace back to a handful of recurring habits. Teams treat the register as a one-time export instead of a living record tied to procurement and vendor-management workflows, so it drifts out of date within weeks of submission. Subcontractors one or two levels down the chain get missed for critical functions, because nobody owns visibility that deep into a provider's own vendor stack. Exit strategies exist on paper but were never operationally validated, which surfaces the moment an auditor asks for evidence of a test run. And inconsistent LEIs or provider names across templates quietly break the automated cross-checks an NCA runs the moment the file lands. How Gart Solutions Helps You Get (and Stay) DORA-Ready Building an accurate DORA register of information is fundamentally an infrastructure and vendor-visibility problem before it's a paperwork problem — you can't document dependencies you haven't fully mapped. Gart Solutions works with fintech, insurance, and payments teams on exactly that groundwork: Compliance audits that map every ICT vendor, contract, and subcontractor against DORA's Article 28 requirements before you build the register. Infrastructure audits that surface shadow IT and undocumented cloud dependencies — the most common source of register gaps. SRE and disaster-recovery engineering to design and actually test the exit strategies your critical-function contracts require. Fractional CTO support for teams that need senior technical ownership of the register-building process without adding full-time headcount. Talk to our team about your DORA readiness Fedir Kompaniiets Co-founder & CEO, Gart Solutions · Cloud Architect & DevOps Consultant Fedir is a technology enthusiast with over a decade of diverse industry experience. He co-founded Gart Solutions to address complex tech challenges related to Digital Transformation, helping businesses focus on what matters most — scaling. Fedir is committed to driving sustainable IT transformation, helping SMBs innovate, plan future growth, and navigate the "tech madness" through expert DevOps and Cloud managed services. Connect on LinkedIn.

If your organization touches EU financial services — as a bank, insurer, payment provider, crypto-asset firm, or as an ICT vendor selling to any of them — a DORA compliance checklist is no longer optional homework. The Digital Operational Resilience Act (DORA) has been fully in force since January 17, 2025, and 2026 is the year national regulators stop reviewing paperwork and start demanding proof: real-time evidence of resilience, tested incident response, and a fully mapped ICT supply chain. This guide breaks DORA's five pillars into a checklist your IT and security teams can actually execute, and shows where a structured compliance audit can shortcut the gap analysis. In short: DORA compliance means proving — with documentation, tested controls, and a maintained Register of Information — that your organization can identify, withstand, respond to, and recover from ICT-related disruptions. It rests on five pillars: ICT risk management, incident reporting, resilience testing, third-party risk management, and information sharing. Non-compliance can cost up to 2% of global annual turnover or €10 million, whichever is higher. What Is DORA, and Who Needs to Comply? What it is: The Digital Operational Resilience Act (Regulation (EU) 2022/2554) is an EU regulation that standardizes how financial entities and their critical technology vendors manage, report, and recover from ICT risk. Unlike earlier frameworks that treated cybersecurity as a checkbox, DORA is built around demonstrable operational resilience — your ability to keep critical functions running through a cyberattack, outage, or vendor failure, not just your ability to write a policy about one. Who it applies to: Per the European Banking Authority, DORA's enforcement perimeter now covers more than 22,000 financial entities — banks, insurers, investment firms, payment institutions, crypto-asset service providers, and trading venues — plus an estimated 15,000 ICT third-party providers that serve them, including cloud platforms, SaaS vendors, and data center operators. If your product touches an EU-regulated financial entity's critical or important function, DORA reaches you contractually even if you're not a financial institution yourself. Fintech platforms in particular should check our breakdown of DevOps and cloud infrastructure for fintech for how this plays out operationally. When it's enforced: DORA became directly applicable across all EU member states on January 17, 2025. 2025 functioned as a de facto transition year, with regulators focused on readiness assessments. In 2026, national competent authorities (NCAs) have moved to active enforcement — formal audits, information requests, and financial penalties are now standard practice. The DORA Compliance Checklist: 5 Pillars You Must Cover Every credible DORA compliance checklist is organized around the regulation's five pillars. Treat each one as a workstream with its own owner, evidence trail, and testing cadence — not a document to file away after the initial audit. Pillar 1: ICT Risk Management Checklist This is DORA's foundation — a governance framework that your board formally owns, not just IT. Auditors will look for evidence, not intent. ICT risk management framework documented, board-approved, and reviewed at least annually Complete inventory and classification of ICT assets, systems, and data flows supporting critical or important functions Defined risk tolerance thresholds tied to business-impact analysis Identity, access, and network security controls mapped to identified risks Business continuity and disaster recovery plans tested, not just written Clear internal accountability — a named function (often the CISO or a dedicated resilience lead) reporting risk posture to the board Most of this pillar overlaps with existing frameworks — if you've already built a risk management system for ISO 27001, you're covering roughly 60–70% of DORA's ICT risk requirements already. Pillar 2: ICT Incident Reporting Checklist DORA replaces vague "notify without undue delay" language with hard deadlines. Your incident response runbook needs these timers built in, not calculated manually under pressure. Incident classification criteria in place (severity, client impact, reputational impact, geographic spread, duration) Initial notification to the relevant national competent authority within 4 hours of classifying an incident as major Intermediate report submitted within 72 hours with updated status and impact assessment Final report submitted within one month, including root cause and remediation Designated Critical ICT Third-Party Providers report major incidents to their Lead Overseer within 2 hours Incident logging and evidence retention process that survives an auditor's request for the last 12 months of history Pillar 3: Digital Operational Resilience Testing Checklist DORA does not accept a policy document as proof of resilience — it requires proof you've broken your own systems on purpose and recovered. Annual basic testing program covering vulnerability assessments, scenario-based tests, and network security assessments Threat-Led Penetration Testing (TLPT) every three years for entities identified as significant, simulating real adversary tactics against production-like environments Testing results tracked to remediation with owners and deadlines, not just filed as a report Independent testers used where required, with results reported to management and regulators as applicable Pillar 4: ICT Third-Party Risk Management Checklist This is the pillar catching the most organizations off guard in 2026, largely because of one deliverable: the Register of Information (RoI). Register of Information covering every ICT third-party contract supporting critical or important functions, in the ITS 2024/2956 format RoI submitted to your national competent authority ahead of the 2026 deadline (most EU states set 31 March 2026; the Netherlands set 22 March 2026) Pre-contractual due diligence process for new ICT vendors, including sub-outsourcing chain visibility Contracts updated with DORA-mandated clauses: audit rights, exit strategies, service levels, and incident cooperation Concentration risk assessed — how many critical functions depend on a single cloud or SaaS provider Monitoring in place for providers designated as Critical ICT Third-Party Providers (CTPPs) by the European Supervisory Authorities If your third-party register includes payment processors, the due-diligence bar is even higher — cross-check it against the controls covered in our PCI DSS audit guide and, for entities also subject to U.S. financial rules, our SOX compliance overview. Pillar 5: Information and Intelligence Sharing Checklist The lightest-touch pillar — encouraged, not mandated — but still worth formalizing so it doesn't fall through the cracks during an audit. Participation (or a documented decision not to participate) in a threat-intelligence sharing arrangement with peers or sector groups Internal process to act on shared indicators of compromise and TTPs, not just receive them Legal and data-protection review of any information-sharing arrangement before joining Reality check: Most organizations we assess have partial coverage on Pillars 1–3 from prior ISO 27001 or SOC 2 work, but a near-blank Register of Information for Pillar 4. Third-party risk management is where a targeted cloud infrastructure and vendor review pays off fastest. Full DORA Compliance Checklist by Pillar Use this table as a working audit tracker — assign an owner and a status to each row before your next internal review. PillarCore RequirementTypical OwnerEvidence NeededICT Risk ManagementBoard-approved risk framework, asset inventory, tested BC/DR plansCISO / IT GovernanceFramework doc, risk register, DR test logsIncident Reporting4-hour / 72-hour / 1-month reporting cadence to NCASOC / Incident Response LeadIncident log, timestamped reports, escalation recordsResilience TestingAnnual testing plus TLPT every 3 years for significant entitiesSecurity / DevSecOpsTest reports, remediation tickets, retest evidenceThird-Party RiskRegister of Information, due diligence, DORA-compliant contractsProcurement / IT AuditRoI submission, contract addenda, vendor risk scoresInformation SharingThreat-intel participation and internal action processCISO / LegalMembership records, IOC-response workflowFull DORA Compliance Checklist by Pillar DORA Compliance Timeline: Key 2026 Deadlines DORA compliance in 2026 is not a one-time deadline — it's a recurring supervisory cycle. These are the dates IT and security leaders should have on their calendar right now. Ongoing: Full DORA applicability since January 17, 2025 — every requirement below is already enforceable. Q1 2026 (31 March for most member states; 22 March for the Netherlands): Annual Register of Information submission to your national competent authority. Throughout 2026: National regulators cross-reference registers across entities, flagging providers that appear inconsistently or "sub-outsourcing chains that don't exist" for major cloud vendors — expect follow-up requests if your data doesn't match your vendors' filings. Rolling: Designated Critical ICT Third-Party Providers — 19 named by the ESAs in November 2025, including major hyperscalers — now operate under direct ESA oversight. Confirm whether any of your critical vendors are on that list and adjust monitoring accordingly. What Happens If You're Not DORA Compliant? Regulators have made clear that 2026 is the enforcement year, and the penalty structure reflects it: Financial entities: Per the official DORA regulation text, fines up to 2% of total annual global turnover or €10 million, whichever is higher, plus individual penalties up to €1 million for accountable executives. Critical ICT Third-Party Providers: Daily penalty payments of up to 1% of average daily global turnover for continued non-compliance, for up to six months, plus corrective measures dictated by the Lead Overseer. Member-state variation: Some countries go further — Italy allows ceilings up to €20 million or 10% of turnover, and Article 52 permits criminal penalties, including imprisonment, for the most severe violations. Beyond fines, the operational cost is often higher: emergency remediation under regulatory scrutiny, contract renegotiation with vendors, and lost enterprise deals once prospective financial-sector clients ask for your DORA evidence during procurement. Common DORA Compliance Mistakes IT Teams Make Across compliance audits, the same gaps recur regardless of company size: Treating DORA as a paperwork exercise. A written policy with no test logs, no incident drill records, and no remediation tracking won't survive an NCA review. Underestimating the Register of Information. Mapping every ICT contract, sub-outsourcer, and data flow into the ITS 2024/2956 format takes longer than teams expect — start well before the March deadline, not the week of. Missing concentration risk. Multiple critical functions quietly depending on one cloud region or one SaaS vendor is a red flag regulators specifically look for. These same failure patterns show up across regulatory checklists generally — our FISMA audit checklist walks through a comparable evidence-first approach if you're benchmarking your audit process against other frameworks. Turn This Checklist Into an Audit-Ready Program Gart Solutions runs compliance audits that map your current ICT risk management, incident response, and third-party contracts directly against DORA, ISO 27001, SOC 2, and NIST requirements — then translate the gaps into a DevOps-executable remediation plan. We work across AWS, Azure, and GCP, so the controls we recommend get built into your CI/CD and cloud infrastructure, not bolted on as a separate process. For teams that need ongoing resilience testing and incident readiness without hiring a full internal security function, our SRE and disaster recovery services and fractional CTO engagements plug directly into your existing team. Get a free DORA readiness consultation Fedir Kompaniiets Co-founder & CEO, Gart Solutions · Cloud Architect & DevOps Consultant Fedir is a technology enthusiast with over a decade of diverse industry experience. He co-founded Gart Solutions to address complex tech challenges related to Digital Transformation, helping businesses focus on what matters most — scaling. Fedir is committed to driving sustainable IT transformation, helping SMBs innovate, plan future growth, and navigate the "tech madness" through expert DevOps and Cloud managed services. Connect on LinkedIn.