NIS2 vs DORA: Scope, Obligations and Overlaps Compared

Both acts appeared in the same Official Journal issue, OJ L 333 of 27 December 2022, and both entered into force on 16 January 2023. DORA has applied since 17 January 2025 (Article 64 DORA), and the Member States had to apply their national measures under the NIS2 Directive from 18 October 2024 (Article 41(1) of Directive (EU) 2022/2555).

This comparison covers the precedence rule, the three entity types both acts cover, five displaced areas, the NIS2 provisions that remain, four national carve-outs and one programme for both acts. The table below compares the two acts point by point.

How Do NIS2 and DORA Differ?

NIS2 is a horizontal directive for 18 sectors that Member States transpose into national law, while DORA is a regulation that applies directly to 20 types of financial entity and their ICT third-party service providers. A German bank reads its NIS2 status in the BSIG 2025 and a Slovenian bank in the ZInfV-1, while the DORA text on EUR-Lex applies unchanged in every Member State.

The two acts meet in two of the 18 NIS2 sectors, banking (Annex I point 3) and financial market infrastructures (Annex I point 4). A precedence rule, not double compliance, settles that overlap. Every other overlap of the Directive with an EU law or a standard is compared under NIS2 and other laws and standards.

A Directive Transposed by Member States and a Directly Applicable Regulation

NIS2 binds Member States (Article 46) and reaches companies only through the national law, while DORA binds financial entities directly from 17 January 2025 (Article 64 DORA). The difference shows in penalties. DORA leaves the penalties to national rules, which the Member States had to notify by 17 January 2025 (Article 53 DORA). NIS2 fixes a floor for the national fine maximums instead: at least EUR 10,000,000 or 2 % of the total worldwide annual turnover for essential entities (Article 34(4)) and at least EUR 7,000,000 or 1.4 % for important entities (Article 34(5)), whichever is higher in each case.

Which Rule Decides Whether DORA Replaces NIS2?

Article 4 NIS2 decides: where a sector-specific Union legal act requires measures or incident notification at least equivalent in effect to NIS2, the corresponding NIS2 provisions, including supervision and enforcement under Chapter VII, do not apply, and Article 1(2) DORA declares DORA to be such an act for financial entities. The Directive sets the test in Article 4(1) and (2) of the Directive text on EUR-Lex, and the Regulation answers it for the financial sector in its own Article 1(2), so the two articles are read together.

The Equivalence Test of Article 4

Article 4(2) NIS2 sets two tests: measures at least equivalent in effect to Article 21(1) and (2) (point (a)), and incident notification at least equivalent to Article 23(1) to (6) with immediate, where appropriate automatic and direct, access for CSIRTs, competent authorities or single points of contact (point (b)). Article 4(1), second sentence, limits the effect to the entities that the sector act covers, and NIS2 continues to apply to every other entity in the sector. The mechanism is not new: Article 1(7) of the first NIS Directive, Directive (EU) 2016/1148, already gave way to sector-specific acts with at least equivalent requirements.

Displacement reaches beyond the duties themselves. Chapter VII (Articles 31 to 37) is among the provisions that do not apply, so the NIS2 audits, inspections, orders and Article 34 fines do not reach an entity that DORA covers. How these Chapter VII powers work for every other entity is set out under NIS2 supervision and enforcement.

Article 1(2) DORA and Recital 28

Article 1(2) DORA states that, for financial entities identified as essential or important entities under the national rules transposing Article 3 NIS2, DORA is a sector-specific Union legal act for the purposes of Article 4 NIS2. The declaration depends on the national NIS2 classification. Recital 28 of NIS2 states the consequence from the Directive's side. Member States should not apply the NIS2 provisions on cybersecurity risk-management and reporting obligations, or on supervision and enforcement, to financial entities covered by DORA. Read together, the two texts displace four blocks: Article 20 on management bodies, Article 21 on measures, Article 23 on reporting and Chapter VII on supervision and enforcement.

What the Commission Guidelines of September 2023 Say

The Commission Guidelines on Article 4(1) and (2) NIS2 (2023/C 328/02), published by the Commission on 14 September 2023 and in OJ C 328 of 18 September 2023, p. 2, are not legally binding and discuss DORA as the only sector-specific Union legal act. The Commission guidelines on Article 4 name five DORA blocks that displace NIS2: ICT risk management (Articles 6 et seq.), incident management and reporting (Articles 17 et seq.), resilience testing (Articles 24 et seq.), information sharing, and ICT third-party risk (Articles 28 et seq.).

The guidelines also state that registration under Articles 3(3) and 27 and the management-body duties of Article 20 should not apply where a sector act governs risk management, because Article 20 is intrinsically linked to Article 21. Member States may still include such entities in their national lists. The registration duty that applies to every other entity is set out under NIS2 registration.

Which Financial Entities Fall Under Both NIS2 and DORA?

Three entity types are both DORA financial entities and NIS2 entities: credit institutions (Annex I point 3), and operators of trading venues and central counterparties (Annex I point 4). The Commission guidelines name the same three types. DORA lists 20 types of financial entity in Article 2(1)(a) to (t) plus ICT third-party service providers in point (u); the other types are not NIS2 Annex types, so DORA alone governs them. The table below shows which act governs risk management and reporting for each group.

The three overlap types are essential entities under NIS2 or important entities under NIS2 by size, in two of all 18 sectors of Annex I and II.

Credit Institutions, Trading Venues and Central Counterparties

A credit institution under NIS2 is an institution as defined in Article 4, point (1), of Regulation (EU) No 575/2013, an undertaking whose business is to take deposits or other repayable funds from the public and to grant credits for its own account. That wording is point (a) of the definition as replaced by Article 62(3) of Regulation (EU) 2019/2033. Annex I point 4 adds two financial market infrastructures: operators of trading venues, meaning a regulated market, an MTF or an OTF under Article 4(1)(24) of Directive 2014/65/EU (MiFID II), and central counterparties under Article 2(1) of Regulation (EU) No 648/2012 (EMIR).

Size still decides the NIS2 category of each of these entities under the national law. A credit institution that exceeds the medium-sized ceilings is an essential entity (Article 3(1)(a)), and a medium-sized credit institution is an important entity (Article 3(2)). Article 1(2) DORA refers to exactly this national classification.

Entities Exempted from DORA and Therefore from NIS2

Article 2(10) NIS2 excludes from NIS2 every entity that a Member State has exempted from DORA under Article 2(4) DORA. Article 2(4) DORA lets Member States exclude entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located in their territory, and the Member State informs the Commission of that exclusion.

An entity exempted this way stands outside both acts: the national exemption removes it from DORA, and Article 2(10) removes it from NIS2. Article 2(10) works like the scope exclusion of Article 2(7) for public administration entities in national security, public security, defence or law enforcement, and both are explained under NIS2 exclusions.

DORA and NIS2 Side by Side: Risk Management, Governance, Reporting and Testing

DORA covers the same five areas as NIS2 for financial entities (ICT risk management, management responsibility, incident reporting, resilience testing and ICT third-party risk), and in each area the DORA provisions displace the corresponding NIS2 article. Registration, supervision and fines complete the comparison. The table below sets each NIS2 article beside the DORA provisions that the Commission guidelines name.

ICT Risk Management and the Ten Minimum Measures

Article 21(2) NIS2 lists at least ten technical, operational and organisational measures, points (a) to (j), while DORA requires an ICT risk-management framework under Articles 6 et seq., which the Commission guidelines treat as the displacing chapter. For an entity covered by DORA, Article 21 serves only as the yardstick of the equivalence test in Article 4(2)(a).

Supply chain duties differ in reach. Article 21(2)(d) NIS2 limits supply chain security to the relationships between the entity and its direct suppliers or service providers, and suppliers are not directly obliged by that point. DORA treats ICT third-party risk as a block of its own (Articles 28 et seq.). An ICT provider that is itself an NIS2 entity keeps its own Article 21 duties, whatever the DORA status of its customers (Article 4(1), second sentence).

Ultimate Responsibility of the Management Body

Both acts put the board in charge: under Article 5(2)(a) DORA the management body bears the ultimate responsibility for managing the financial entity's ICT risk, and under Article 20(1) NIS2 it approves and oversees the cybersecurity risk-management measures and can be held liable for infringements. Article 20(2) NIS2 adds a training duty for the members of the management body, without setting a frequency.

For a DORA financial entity, Article 20 NIS2 is displaced together with Article 21, so the DORA duty defines the board's role in a bank or a market infrastructure. Every NIS2 entity outside DORA follows the rules on what NIS2 management bodies must approve and oversee.

How Do the Two Incident Clocks Compare?

DORA starts earlier: the initial notification of a major ICT-related incident is due within 4 hours of its classification as major and no later than 24 hours after the entity became aware of it (Article 5(1)(a) of Delegated Regulation (EU) 2025/301), against the 24-hour early warning of Article 23(4)(a) NIS2.

The intermediate report is due within 72 hours of the initial notification (Article 5(1)(b)), and the final report no later than one month after the latest updated intermediate report (Article 5(1)(c)), whereas the NIS2 final report is due one month after the incident notification (Article 23(4)(d)). Significant credit institutions send their reports to the national competent authority under Article 4 of Directive 2013/36/EU, which transmits them immediately to the European Central Bank (Article 19(1) DORA). The time limits are set in the Delegated Regulation on EUR-Lex.

Article 5(4) of Delegated Regulation (EU) 2025/301 allows a report to be submitted by noon of the next working day, and Article 5(5) withholds that relief for the initial notifications and intermediate reports of credit institutions, central counterparties, trading venues and other financial entities that are essential or important entities under NIS2. The full NIS2 sequence for every other entity is set out under NIS2 incident reporting deadlines.

Resilience Testing and Critical ICT Third-Party Providers

DORA requires threat-led penetration testing (TLPT) at least every 3 years for identified financial entities (Article 26(1) DORA), while NIS2 asks for policies and procedures to assess the effectiveness of cybersecurity risk-management measures (Article 21(2)(f)). Point (f) is internal assurance by the entity, distinct from the supervisory audits of Article 32(2)(b) and Article 33.

The two acts also meet at critical ICT third-party service providers. When an essential or important entity is designated as a critical ICT third-party service provider under Articles 31 and 32 DORA, the NIS2 competent authority that supervises it informs the DORA Oversight Forum (Article 32(10) NIS2 for essential entities, Article 33(6) NIS2 for important entities).

Which NIS2 Provisions Still Apply to Financial Entities?

Five sets of NIS2 provisions keep applying to financial entities under DORA: the national strategy (Article 7), crisis management frameworks (Article 9), EU-CyCLONe (Article 16), the classification as essential or important that Article 1(2) DORA relies on, and cooperation between NIS2 and DORA authorities. The five sets are listed below.

• National strategy (Article 7): the financial sector stays in the national cybersecurity strategy; the bodies are listed under NIS2 competent authorities.
• Crisis management frameworks (Article 9): national cyber crisis management frameworks still cover DORA entities.
• EU-CyCLONe (Article 16): the EU cyber crisis liaison network still covers DORA entities.
• Classification (Article 3): the national NIS2 law still identifies a credit institution, trading venue or central counterparty as essential or important.
• Cooperation between authorities: NIS2 authorities cooperate nationally with DORA authorities (Article 13(4) and (5)); the European Supervisory Authorities and DORA competent authorities may take part in the NIS Cooperation Group (Article 14(3)); and Article 19(1), last subparagraph, DORA lets Member States require a copy of DORA reports for the NIS2 competent authorities or CSIRTs under NIS2.

NIS2 therefore still concerns a bank, and a national registration duty can remain, as the next section shows.

How Do National Laws Handle the DORA Carve-Out?

The four national laws in the table below implement the carve-out in their own words, and Germany shows that an exemption from the NIS2 duties need not include registration: § 28(6) BSIG switches off §§ 30, 31, 32, 35, 36, 38 and 39 for DORA financial entities but not the § 33 registration duty. Luxembourg and Portugal assign DORA entities to their financial supervisors, and Slovenia disapplies two chapters of its act. The status of every Member State's NIS2 law is kept in the NIS2 transposition tracker.

Germany splits the two roles between authorities: BaFin is the DORA authority, and the BSI remains the NIS2 authority that receives the § 33 registration. The BaFin DORA FAQ explains the Article 1(2) rule from the financial supervisor's side.

How to Run One Programme for Both Acts

Run one control programme for both acts by deciding first which act governs each duty, then building one evidence base that serves the DORA authority and any remaining NIS2 duty. The five steps are listed below.

1. Confirm the NIS2 classification as essential or important and any DORA exemption under Article 2(4) DORA, starting with the NIS2 scope check.
2. Map each Article 21(2) measure to the DORA block that displaces it (ICT risk management, incident reporting, resilience testing or ICT third-party risk) and keep one control set, as described for NIS2 vs ISO/IEC 27001.
3. Merge the two incident clocks into one playbook that starts with the 4-hour DORA initial notification and records the time of classification.
4. Check the national carve-out, including whether registration still applies, as § 33 BSIG requires in Germany.
5. Keep one NIS2 gap analysis for both acts, covering the DORA blocks and the NIS2 provisions that remain.

What Pending Changes Affect NIS2 and DORA Reporting?

One pending proposal touches both acts: the Digital Omnibus, COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)), would amend Article 19 DORA and NIS2 to route incident reports through a single-entry point, and as of 23 October 2026 it is pending, with the European Parliament's joint ITRE/LIBE committees at "Awaiting committee decision" and a Council mandate agreed by Coreper on 21 October 2026. The procedure file is kept in the EP Legislative Observatory.

ENISA would develop and maintain the single-entry point, which would also receive reports under the GDPR, eIDAS (Regulation (EU) No 910/2014) and the CER Directive. The proposal is not law, so the rules described above apply. Every pending change to the Directive is tracked under NIS2 amendments and review.

Three related comparisons are listed below.

• NIS2 vs the GDPR: breach notification beside NIS2 reporting.
• NIS2 vs the CER Directive: critical entities and their incident notifications.
• NIS2 vs the Cyber Resilience Act: Regulation (EU) 2024/2847, whose single reporting platform the proposed single-entry point may build on.

NIS2 and DORA Questions

Four questions recur when NIS2 and DORA are compared.

Do banks have to comply with both NIS2 and DORA?

No: a credit institution identified as essential or important follows DORA for risk management, incident reporting and supervision, and NIS2 still governs its classification and the national cooperation around it (Article 4 NIS2, Article 1(2) DORA). National registration can still apply, as § 33 BSIG shows in Germany.

Are ICT providers to financial entities covered by NIS2 or DORA?

Often by both, in different roles: DORA reaches them as ICT third-party service providers (Article 2(1)(u) DORA), and NIS2 covers them in their own right when they are an Annex I type, such as cloud computing service providers or managed service providers, and meet the size rule. For a provider designated as critical under DORA, the NIS2 authorities inform the Oversight Forum; the NIS2 rules are set out under managed service providers.

Does a DORA major incident report also count under NIS2?

For a DORA financial entity the DORA report replaces the NIS2 report, because Article 23 NIS2 is displaced; Article 19(1) DORA lets Member States require a copy for the NIS2 competent authority or CSIRT. Whether a Member State uses that option is set in its national law.

From which dates do NIS2 and DORA apply?

The Member States had to apply their national NIS2 measures from 18 October 2024 (Article 41(1)), and DORA has applied since 17 January 2025 (Article 64); both acts entered into force on 16 January 2023.