Regmindr
DeadlinesGuidesTemplatesPricingSign inCreate account
Guides

DORA compliance calendar: what recurs and when

Updated

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025, and most of what it asks for repeats. Every year you submit the register of information as at 31 December, in a first-quarter window set by your competent authority, and review or test your ICT risk framework, continuity plans and critical systems. Firms their authority selects run threat-led penetration testing at least every 3 years, and every major ICT-related incident starts a 4-hour, 72-hour and 1-month reporting clock.

Table of recurring DORA obligations: register of information yearly as at 31 December (Art. 28(3)); ICT risk management framework review at least once a year (Art. 6(5)); ICT assets and risks review at least yearly (Art. 8); business continuity plan testing at least yearly (Art. 11(6)); testing of systems supporting critical or important functions at least yearly (Art. 24(6)); ICT report to the management body at least yearly (Art. 13(5)); threat-led penetration testing every 3 years if selected (Art. 26); major incident reports at 4 hours, 72 hours and 1 month (Delegated Regulation 2025/301).
How often each obligation recurs. Microenterprises and firms under the simplified framework have lighter versions of some of them.

Every year: the register of information

Under Article 28(3), you keep a register of every contract for ICT services provided by third parties, showing which ones support critical or important functions, and report on it to your competent authority at least once a year. Its templates are set by Implementing Regulation (EU) 2024/2956.

  • The register is brought up to date as at 31 December.
  • Each authority collects it in the first quarter and passes it to the European Supervisory Authorities by the end of March.
  • Your window is set nationally. For the 2026 register, Luxembourg's CSSF accepted submissions from 11 February to 31 March, and Malta's MFSA from 1 January to 21 March.

Authorities run validation checks on every submission, and the CSSF has warned that they now cover more fields, so leave time to fix errors before your window closes. See the register of information for the detail.

At least once a year: reviews and tests

  • Review the ICT risk management framework (Art. 6(5)).
  • Review the identification and classification of your ICT assets and risks (Art. 8).
  • Test your ICT business continuity and response and recovery plans (Art. 11(6)).
  • Test the ICT systems and applications that support critical or important functions (Art. 24(6)).
  • Report on ICT findings to the management body (Art. 13(5)).

Microenterprises get lighter versions of some of these, such as a periodic rather than yearly framework review. Where DORA only says "regularly", as for the ICT audit and the third-party risk strategy, a yearly date keeps the obligation from drifting.

Every 3 years: threat-led penetration testing

Only firms their competent authority selects have to run threat-led penetration testing, and then at least every 3 years (Art. 26). Tests cover critical or important functions on live production systems, follow the TIBER-EU approach and end with an attestation from the authority. Microenterprises and firms under the simplified framework are out of scope.

On every major incident

When an ICT-related incident is major under the criteria in Delegated Regulation (EU) 2024/1772, three reports follow, with time limits set by Delegated Regulation (EU) 2025/301:

  • Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
  • Intermediate report: within 72 hours of the initial notification, even if nothing has changed.
  • Final report: within a month of the latest intermediate report, with the root cause.

Four hours leaves no time to work out the process, so rehearse it in your yearly continuity test. See DORA incident reporting deadlines for weekends, bank holidays and client notices.

Get reminded before each deadline

Regmindr sets up your compliance calendar from a template in about two minutes, and emails your team before each deadline is due.

Set up your compliance calendarSee pricing

Sources

This page is a summary, not legal or regulatory advice. The rules in the sources above take precedence.

Related