Short answer: DORA is EU law, so it does not apply to a UK company simply because the company is in the UK or is a UK financial firm. It reaches UK organisations in three practical ways: through an EU-authorised subsidiary, through contracts with EU financial customers who must pass DORA's requirements on to their ICT suppliers, and, for a small number of very large providers, through direct EU oversight. For most UK technology suppliers the real exposure is the contract and the evidence that sits behind it: a due-diligence questionnaire that asks you to show how your cloud environment is configured, monitored and backed up.
This guide explains who is in scope, what an EU financial customer is likely to ask a UK supplier for, and how to keep cloud evidence that answers those questions. It is general information, not legal advice. If you are unsure whether DORA covers a specific legal entity, take advice from a qualified lawyer. The wording of each article below is paraphrased from the regulation and its regulator pages, linked in the sources at the end.
What DORA is and when it applies
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied across the EU since 17 January 2025. It covers more than 20 types of EU financial entity, including banks, payment and e-money institutions, investment firms, insurers, fund managers and crypto-asset service providers, and sets common rules for ICT risk management, incident reporting, resilience testing and the management of ICT third-party risk. The European Supervisory Authorities (ESAs) also oversee a list of designated critical ICT third-party providers directly. Their ESMA overview of DORA sets out how the regulation and its technical standards fit together.
DORA began applying after the UK had left the EU, and it was not carried into UK law. A UK firm with no EU entity and no EU financial customers is generally outside it and answers to its UK regulators instead.
Does DORA apply to UK companies? Three routes in
| Your situation | Does DORA matter? | Why |
|---|---|---|
| UK business with no EU entity and no EU financial customers | Generally no | DORA is not UK law; UK rules apply instead. |
| UK group with an EU-authorised financial subsidiary | Yes, for that subsidiary | The subsidiary is a financial entity in its own right, and its UK parent or group IT provider becomes an ICT third party to it. |
| UK software or cloud supplier to EU financial firms | Yes, by contract | Article 30 requires your customers to include specified terms in ICT contracts, and Article 28 requires them to assess and record you as a supplier. |
| Provider designated as critical at EU level | Yes, directly | Subject to ESA oversight; a third-country provider designated as critical must establish an EU subsidiary within 12 months under Article 31(12). |
The supplier route catches most UK technology businesses. The ESAs published the first list of designated critical providers on 18 November 2025, but it is short and made up of very large organisations, so a typical UK SME will meet DORA through a customer's contract and questionnaire, not through a regulator.
What an EU financial customer will ask of you
Under Article 28, a financial entity must manage ICT third-party risk and keep a register of information on all of its contractual arrangements for ICT services. Under Article 30, those contracts must include key provisions. For services that support a critical or important function, the expectations go further. In practice you will see requests such as:
- A clear service description and the locations (regions and countries) where services run and data is processed or stored.
- Security and availability commitments, including how access to data is controlled and how data is protected.
- Incident assistance and a way to tell the customer quickly when something affects their service.
- Audit, access and cooperation rights for the customer and its supervisors, scaled to how important the service is.
- Exit and termination arrangements, including getting data back.
- Sub-contractors you rely on, because the customer's register has to capture the supply chain, not just you.
A questionnaire answer such as "we follow best practice" rarely survives follow-up. A better answer points to a dated record of what your cloud accounts actually looked like.
Cloud evidence that supports a DORA-style questionnaire
DORA's ICT risk management chapter asks financial entities for things such as asset identification, protection and prevention, detection, response and recovery, and backup and restoration. As a supplier you are not assessed against those articles directly, but customers read your answers through them. These are the cloud checks that map most naturally to what they ask, whether you run on AWS, Azure or Google Cloud:
- Asset and region inventory. A list of accounts, subscriptions or projects and the regions in use. This backs your answer about where services and data are located.
- Identity and access. Multi-factor authentication on administrator and privileged roles, no unused or over-privileged access keys, and a recent review of who holds admin rights.
- Encryption. Storage, databases and backups encrypted at rest, and encryption in transit enforced on public endpoints.
- Public exposure. No storage, databases or management ports open to the internet without a reason you can explain.
- Logging and detection. Audit logging switched on in every account and region, retained for a stated period, with alerting on high-risk events.
- Backup and recovery. Backups enabled for the services that matter, retention set, and a recent restore test you can describe.
- Change over time. Evidence of what you found, what you fixed and the date it was fixed. For the common failure modes, see common cloud misconfigurations and how to prove a fix.
Each item should produce something a reviewer can check without logging in to your console: an export, a dated report, or a record you can verify independently.
Keep the evidence consistent across frameworks
EU customers rarely ask for DORA alone. The same cloud settings answer SOC 2 and ISO 27001 questions, and they overlap heavily with NIS2, which many of the same customers also face. Our NIS2 cloud compliance checklist maps Article 21 measures to the same AWS, Azure and Google Cloud settings, and multi-cloud compliance auditing with one scan explains how to collect them once and reuse them. Keeping one dated record per control, rather than a new screenshot folder for each questionnaire, is what keeps your answers consistent when three customers ask in the same quarter.
If you are a UK financial firm, what applies instead
UK-authorised firms do not follow DORA, but they are not free of similar obligations. The FCA's PS26/2 sets single FCA, PRA and Bank of England regimes for operational incident reporting and for material third-party arrangements, applying from 18 March 2027. For third-party reporting, in-scope firms must maintain a register of their material third-party arrangements and submit it to the FCA annually. That means UK firms will also be asking their cloud and software suppliers for structured information, which makes dated, exportable evidence useful on both sides of the Channel. Check the FCA page for which firm types are in scope.
A 30-minute readiness check for a UK supplier
- List the EU financial customers you have, or expect to have, and ask which of them have started DORA contract updates.
- Read the ICT clauses they send you against your real service: locations, sub-contractors, incident notice, audit rights, exit.
- Run the seven cloud checks above and keep the output with a date.
- Fix what the checks show, then re-run them so the fix is on record.
- Store one answer per topic and reuse it, updating it when the evidence changes.
Where PyraLink™ Prove fits
PyraLink Prove does one part of this job. It connects to AWS, Azure and Google Cloud with read-only access, checks Microsoft 365 and Google Workspace read-only, and maps each check to ISO 27001, SOC 2, Cyber Essentials, NIS2 and DORA. Each result is kept as digitally signed, dated evidence records that you can verify independently, and reports export as JSON, CSV, PDF and HTML so they can be attached to a questionnaire response. It supports your answers with evidence; it does not decide whether DORA applies to you, and it is not a legal opinion. For how it sits next to broader compliance platforms, see the Vanta vs Drata comparison for UK teams.
Sources
- Regulation (EU) 2022/2554 (DORA), EUR-Lex.
- Digital Operational Resilience Act (DORA), ESMA.
- PS26/2: Operational incident and third party reporting, FCA, 18 March 2026.
- ESAs designate critical ICT third-party providers, 18 November 2025.
Frequently asked questions
Does DORA apply to UK companies?
Not directly. DORA is EU law and began applying on 17 January 2025, after the UK left the EU. It can still affect a UK company through an EU-authorised subsidiary, through contracts with EU financial customers, or through EU-level designation as a critical ICT provider.
Does DORA apply to a UK software or cloud supplier?
Usually by contract. EU financial entities must include specified terms in their ICT contracts and record their suppliers in a register of information, so a UK supplier typically receives DORA-driven clauses and questionnaires even though no UK regulator enforces DORA.
What is the UK equivalent of DORA?
There is no single equivalent. UK financial firms follow operational resilience rules, the critical third parties regime and, from 18 March 2027, the FCA and PRA incident and third-party reporting rules described in PS26/2.
What cloud evidence do EU customers ask for?
Typically where services and data are located, how access is controlled, whether data is encrypted, whether logging and backups are enabled, and how you find and fix problems. Dated records of those settings answer the questions more convincingly than policy statements.
Can PyraLink Prove make us DORA compliant?
No tool can. PyraLink Prove collects read-only cloud evidence mapped to DORA and other frameworks so you can answer customer questions with dated, verifiable records. Whether and how DORA applies to you is a legal question.