The First Full Year of DORA: Turning a Regulatory Sprint into Lasting Resilience.

By Marissa Weiss, Enterprise Sales & Product Specialist at Performativ

When the Digital Operational Resilience Act (DORA) went into effect in January 2025, regulated financial entities across Europe faced a clear mandate: maintain a comprehensive register of their Information Communication Technology (ICT) network and report it to regulators in the required technical format. For many firms, the challenge wasn’t awareness; it was execution. DORAedge was built to provide these entities with both a reliable regulatory reporting tool and a platform to bring this ICT network information to life for ongoing monitoring and management. 

2025 was the first test: the inaugural reporting cycle, a large-scale data mobilization, and the shift from “DORA preparation” to day-to-day compliance. 

From scattered source data to regulator-ready Registers of Information 

The first reporting window in spring 2025 came with hard national deadlines and strict validation rules. In the run-up, we supported clients from two different starting points to ensure they cataloged accurate ICT network information and submitted valid reports. 

1. Firms who had already created their registers. 

These teams often had months of work captured in spreadsheets or internal databases. Their priority was speed and accuracy: validate that their ICT networks were correctly defined, then re-express existing data in the European Supervisory Authorities’ template aligned to the EBA Data Point Model (DPM) 4.0 and xBRL-CSV technical standards. DORAedge facilitated validating the data and importing it into the app, creating a governed system of record and efficiently achieving the reporting requirements. 

2. Firms who had not yet created their registers. 

These clients leveraged the intuitive DORAedge app to enter their ICT network data directly. Contracts became connective tissue, linking legal entities and branches to functions, and the third-party providers that power them. This ensured that relationships were traceable and consistent on entry without the hassle of mastering the complex technical standards for the report. 

Across both pathways, the output was the same: a complete Register of Information in the official template structure, enabling specific levels of consolidation, validated against DPM 4.0 logic, and exportable in the required xBRL-CSV format. 

Beyond reporting: making ICT networks usable 

A standardized reporting template is necessary for regulatory supervision, but it is not designed for operational decision-making. Entities who were previously preparing their Register of Information as a reporting deliverable found the prescribed structure difficult to interpret and unsuitable for proper ongoing compliance monitoring and management. 

DORAedge is designed to give cross-functional teams easy-to-access and -understand data lists and dynamic views of their network. Teams can explore their Provider landscape by filtering for key categorical information and individual profiles including every linked Entity, Branch and Function, plus the Contracts that bind those relationships. This turns a hard-to-interpret compliance table into a living ICT map that can be reviewed, monitored, and maintained cross-functionally. 

Register data naturally became a single source of truth for other DORA obligations such as risk and incident management. Teams can build off the ICT network backbone to identify, track, and monitor related risks and incidents, sourcing key data points to efficiently create reports that satisfy requirements. 

Reflecting on the first year of the regulation 

What we have heard from and experienced with our clients in 10 European jurisdictions:

1. The first ICT network data collection wave was taxing. 

Leading into spring 2025, many firms found Register of Information creation resource-intensive and difficult to interpret. Recording data in EBA DPM codes rather than plain language raised a barrier: organizations needed people to become DORA specialists, fluent in the taxonomy to build and validate the report. DORAedge removes that dependency by translating the regulatory structure into business-readable workflows while still producing fully compliant outputs. 

2. This isn’t a one-off project. 

The Register is not just an annual exercise. Firms must maintain the Register of Information at all times, and those who haven’t operationalized the process face both non-compliance and a recurring, full-scale effort every year. With DORAedge, teams can easily maintain networks continuously and generate compliant reports on demand at the right consolidation level for each entity and regulator. 

3. There’s no opting out. 

All DORA obligations will remain in 2026 and beyond. That reality is sharpened by the recent EU’s critical third-party provider designations, which will shape oversight expectations for years to come. For firms who are still maintaining registers in spreadsheets, the risk is operational drift: data becomes stale, ownership is unclear, and cross-functional updates are slow. Moving the register into a governed system like DORAedge turns compliance into a maintained compliance capability instead of a yearly reporting scramble. 

Looking ahead 

If 2025 was about getting the first Register right, 2026 will be about making resilience measurable and continuous. DORAedge will keep evolving so firms can evidence compliance, understand ICT dependencies, and manage risk dynamically, making DORA not just a regulation to satisfy, but a framework that genuinely strengthens operational resilience across Europe. 

If you’re interested in optimizing your DORA compliance operations, reach out to connect@doraedge.com for more information and a product demo.