Insurance companies increasingly depend on cloud infrastructure, policy administration platforms, claims systems, data providers, artificial intelligence tools and outsourced technology. DORA treats the resilience of those systems as a board-level risk-management issue rather than a narrow IT task.
Regulation (EU) 2022/2554 requires in-scope financial entities to maintain a sound, comprehensive and documented ICT risk-management framework. The rules are directly applicable across EU Member States, while detailed regulatory and implementing technical standards add operational requirements.
Who in insurance is covered?
DORA applies to insurance undertakings, reinsurance undertakings and many other financial entities. The regulation also addresses insurance intermediaries, with exemptions for certain microenterprises and small or medium-sized intermediaries. Scope questions should be checked against the legal text and applicable supervisory guidance.
The five practical pillars of DORA
| Pillar | Insurance implication |
|---|---|
| ICT risk management | Governance, controls, asset protection, detection, response, recovery and learning |
| Incident reporting | Major ICT incidents may require structured notification to competent authorities |
| Resilience testing | Regular testing of systems and controls, with advanced testing for certain entities |
| Third-party risk | Due diligence, contractual controls, registers of information and exit planning for ICT providers |
| Information sharing | Framework for voluntary cyber-threat intelligence sharing under conditions |
Management responsibility is explicit
DORA states that the management body has ultimate responsibility for managing ICT risk. That makes cyber and operational resilience a governance topic for senior executives and boards, including budget, roles, risk tolerance and oversight of remediation.
Why third-party technology contracts matter
Insurers can outsource technology, but they cannot outsource accountability. DORA requires organizations to understand and monitor ICT third-party dependencies. Contracts supporting critical or important functions can need specific provisions, and firms must maintain structured information about technology arrangements.
EU authorities have continued to publish technical standards and Q&A on topics such as subcontracting, incident reporting, testing and third-party risk. That means compliance is not a one-time project completed on the application date.
What insurers should have operationally
- A current inventory of critical systems and information assets.
- Clear ownership for ICT risk and incident escalation.
- Business continuity and disaster recovery that are tested, not merely documented.
- Third-party provider due diligence, contract controls and concentration-risk analysis.
- Incident classification and regulatory reporting procedures.
- Evidence of testing, remediation and management follow-up.
- Exit strategies for critical or important outsourced ICT services.
DORA and cyber insurance are not the same thing
Cyber insurance can transfer part of an organization’s financial risk, but it does not satisfy regulatory resilience duties. DORA is about governance and operational capability: preventing, withstanding, responding to and recovering from ICT disruption.
Frequently asked questions
When did DORA start applying?
17 January 2025.
Does DORA apply only to banks?
No. It covers a broad range of financial entities, including insurance and reinsurance undertakings in scope.
Does using a cloud provider transfer responsibility to the vendor?
No. In-scope financial entities remain responsible for managing ICT third-party risk and contractual arrangements.
Sources & further reading
Reviewed against EUR-Lex, European Commission and EIOPA material in September 2026. This is a general explainer and not legal or compliance advice.
