Published
Summary: For financial entities within the scope of DORA, DORA is the main regime for ICT risk and incident reporting, even where the entity is also affected by the Swedish Cybersecurity Act: the Act gives way to sector rules with at least equivalent requirements. Other organisations follow the Cybersecurity Act (NIS2) if they operate in one of the Act’s sectors and reach the size threshold. ICT providers to the financial sector meet DORA through their customers’ contracts, and may at the same time be affected by the Cybersecurity Act themselves.
The short rule
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 directly to the financial entities the regulation lists: banks, insurers, investment firms, payment service providers and several other categories. The Swedish Cybersecurity Act (2025:1506), which implements NIS2, has applied since 15 January 2026 to essential and important entities in the Act’s sectors, which include banking and financial market infrastructure.
The overlap is resolved in the Act itself. Where another statute imposes requirements on security measures or incident reporting with at least equivalent effect, those apply instead of the Act’s requirements in chapter 2, sections 3 to 10 (chapter 1, section 10 of the Cybersecurity Act). For financial entities within the scope of DORA, DORA is such a statute. Other obligations under the Act, such as registration, may still apply.
Which applies to you? Three questions
- Are you a financial entity that DORA lists? Then DORA is your regime for ICT risk, incidents, testing and third-party risk. Next, check whether you are also an entity under the Cybersecurity Act and which of the Act’s obligations then remain.
- Do you deliver ICT services to financial entities? Then you meet DORA through your customers’ contracts. DORA sets contractual requirements for all ICT services, and services supporting critical or important functions carry more extensive ones, including monitoring, access and audit, and exit. A provider designated as critical is also directly overseen by the European Supervisory Authorities. At the same time you may be affected by the Cybersecurity Act yourself, for example in digital infrastructure or ICT service management.
- Neither? Then the question is whether you operate in one of the Cybersecurity Act’s sectors and reach the size threshold. As a main rule, private entities in the sectors concerned are affected if they have at least 50 employees or if both annual turnover and balance sheet total exceed EUR 10 million. There are several exceptions and special rules, including for certain operations that are affected regardless of size. Start with our self-assessment.
Where the regimes differ
| Area | DORA | Swedish Cybersecurity Act (NIS2) |
|---|---|---|
| Legal act | EU regulation, directly applicable. | Swedish act implementing the EU NIS2 Directive. |
| Applies since | 17 January 2025. | 15 January 2026. Supplementary regulations have entered into force stepwise during 2026, including on incident reporting and, from 1 October, on security measures, management training, security audits and security scanning. |
| Who | The financial entities DORA lists. ICT providers designated as critical are also subject to DORA’s separate European oversight framework. | Essential and important entities in the Act’s sectors. |
| Supervision in Sweden | Finansinspektionen, the Swedish FSA. | The supervisory authority for each sector. |
| Incident reporting | Initial notification within four hours of classification as major and no later than 24 hours after awareness, intermediate report within 72 hours of the initial notification, final report within one month of the latest intermediate report. To Finansinspektionen. | Notice within 24 hours, incident report normally within 72 hours, final report within one month. Via the Cyber Portal to NCSC. |
| Testing | Risk-based testing programme, tests at least yearly of systems supporting critical or important functions, advanced penetration testing (TLPT) at least every three years for certain entities. | Procedures to assess whether the measures work. |
| Third parties | Register of information on ICT contracts, contractual requirements, exit plans for critical or important functions and concentration risk. | Supply chain security. |
| Management | The management body bears responsibility and must keep its knowledge of ICT risk up to date through regular training (Article 5(4)). | Management must approve and follow up the measures and undergo training (chapter 2, section 4). |
If you are affected by both
A financial entity that is also an entity under the Cybersecurity Act does not need to build two systems. DORA governs ICT risk management and incident reporting. Check which of the Act’s other obligations still apply and document the assessment, so that you can show how you reached it.
Build one ICT risk framework that can be demonstrated against both. An ISO 27001 management system is a good foundation for governance and risk work. DORA adds requirements the standard does not set, above all the testing programme, the register of information and the reporting to Finansinspektionen.
ICT providers: what tends to surprise
DORA is addressed to financial entities, but the requirements land with the providers through the contracts. Expect questions about where data is held, how incidents are reported to the customer, audit rights, participation in the customer’s tests and how an exit works.
A provider serving both financial customers and others may need to answer DORA’s contractual requirements while following the Cybersecurity Act in its own operations. How the third-party requirements fit together is described in Third-party risk management under EBA, NIS2 and DORA.
A gap analysis against DORA or the Cybersecurity Act shows which regime applies, where you stand and what remains.
Frequently asked questions
Do both DORA and the Cybersecurity Act apply to a bank?
DORA applies to the bank’s ICT risk management and incident reporting. The Cybersecurity Act gives way in those areas because DORA has at least equivalent requirements, but other obligations under the Act, such as registration, may still apply.
Are we affected by DORA if we deliver IT services to an insurer?
Not directly, unless you have been designated a critical ICT third-party provider. You are affected through the contracts: DORA sets contractual requirements for all ICT services, and more extensive ones, including audit and exit, when the service supports a critical or important function.
What are the reporting deadlines under DORA?
Initial notification within four hours of the incident being classified as major and no later than 24 hours after you became aware of it, intermediate report within 72 hours of the initial notification, and final report within one month of the latest intermediate report.
Is ISO 27001 enough for DORA?
It is a good foundation for governance and risk work, but DORA sets its own requirements that the standard does not cover, including the testing programme, the register of information on ICT contracts and the reporting to Finansinspektionen.
Want to know which regime applies to you and what it means in practice? Read more about our work on DORA and digital operational resilience or contact us.
Sources: Cybersäkerhetslag (2025:1506) · Regulation (EU) 2022/2554 (DORA) · Finansinspektionen: ICT risk (DORA) · Directive (EU) 2022/2555 (NIS2). Verified 2 October 2026.
This text is general information, not legal advice. Which regime applies to you depends on your operations and should be assessed case by case.