Digital Operational Resilience Act (DORA)

Partly. An IORP operating schemes with fewer than 15 members in total is entirely out of scope under Article 2(3). An IORP with fewer than 100 members that the Netherlands has excluded under Article 5 of Directive (EU) 2016/2341 falls under the Article 16 simplified ICT risk management framework, which is materially lighter and carries no threat-led penetration testing obligation. An 80-member fund therefore sits in the Article 16 tier if the Dutch Article 5 exclusion reaches it, and in the full regime if it does not.

Both, and they are cumulative outer limits. The initial notification must be sent as early as possible, within 4 hours of classifying the incident as major, and in any case no later than 24 hours from becoming aware of it. Where classification only happens more than 24 hours after awareness, the 4-hour-from-classification limit governs. Then: intermediate report within 72 hours of the initial notification even if nothing has changed, an updated intermediate report once regular activities are recovered, and a final report within one month. Source: Delegated Regulation (EU) 2025/301.

Usually not, if you are a bank. A deadline falling on a weekend or public holiday may be postponed to noon of the next working day, but that extension is not available to financial entities that also qualify as essential or important entities under NIS2. Most Dutch banks, insurers and larger institutions fail that carve-out and must file over the weekend. Check your NIS2 classification before you rely on the extension, not after.

No. DNB states expressly that institutions within the scope of NIS2 must also report the incident to the NCSC, in addition to the DORA report to DNB. This is a Dutch national channel requirement, not a DORA one, and it is not mirrored in Germany or Ireland. Building a single reporting runbook that only targets the supervisor will miss it.

Two, on different dates. The reference date is the same, 31 December 2025 for the 2026 cycle, but DNB's window ran from 2 to 20 March 2026 through MyDNB, and the AFM's deadline was 31 March 2026 through the AFM Portaal, with resubmissions welcomed to 30 April. Establish which authority is competent for your licence in Bijlage 35 of the Besluit EU-verordeningen Wft, and calendar the earlier date.

No, and the inference runs the wrong way. Designation under Article 31 triggers direct EU-level oversight of the provider by a Lead Overseer. It does not reduce, transfer or discharge any of your own obligations. Your Articles 28–30 duties (the register of information, the mandatory contractual provisions, the concentration risk assessment, the exit strategy) and the subcontracting conditions in Delegated Regulation (EU) 2025/532 apply to every ICT third-party provider supporting a critical or important function, designated or not. Nineteen providers were designated against a population the ESAs estimated at roughly 15,000 serving the EU financial sector.

Yes. The Commission's rejection of 22 January 2025 delayed the standard; it did not remove it. An amended version was adopted on 24 March 2025 as Commission Delegated Regulation (EU) 2025/532, is published in the Official Journal, and applies. Contractual arrangements for ICT services supporting critical or important functions must meet its conditions on subcontracting.

Not so far. The Digital Omnibus stream and the Commission's proposal of 20 January 2026 amend the NIS2 Directive, not DORA. As at 17 August 2026 there is no Commission legislative proposal amending Regulation (EU) 2022/2554. The one live review is narrow: Article 58(3) asks whether statutory auditors and audit firms should face strengthened digital resilience requirements, and whether DORA or the Audit Directive is the right vehicle. The Commission sent its letter to Parliament and Council on 9 January 2026.

The AFM's first published findings, on 11 June 2026, are the best available proxy. Gap analyses done at too high a level, so requirements were simply missed. Weaknesses in security monitoring, access control, logging, emergency changes and continuity management. Policies and procedures not clearly separated, leaving it unclear which document discharges which obligation. And intragroup ICT services not consistently brought under the DORA policy. The AFM expects granular, periodic assessments and controls demonstrated in operation.