The European Digital Operational Resilience Act (DORA), which entered into application on January 17, 2025, is now fully embedded within the financial sector supervisory framework. Following a 2025 largely dedicated to supporting financial entities in implementing their new obligations, 2026 marks a phase of heightened supervision. Competent authorities, including the ACPR in France, are notably stepping up their oversight of incident management, ICT risk management frameworks, and relations with IT service providers.
DORA thus establishes a harmonized framework aimed at strengthening the digital operational resilience of European financial entities and also sets up a European oversight mechanism for critical third-party ICT service providers.
Stepped-up supervision
The Autorité de contrôle prudentiel et de résolution (ACPR) has outlined its priorities for 2026. After prioritizing support for financial entities in 2025, it is now focusing its attention on three main areas: improving the incident management process, evaluating the ICT risk management framework, and ensuring DORA compliance for contracts signed with ICT third-party providers.
This focus on outsourcing-related risks is particularly critical. Managing third-party risk represents a major organizational challenge for numerous financial institutions. Mapping providers, identifying services supporting critical or important functions, and mastering dependencies are becoming essential to ensure the resilience of the entire value chain.
The principle is clear: relying on an external provider does not relieve the financial entity of its responsibilities regarding ICT risk management. DORA thus reinforces the necessity of managing the risks associated with the organization's entire digital ecosystem.
Data driving action
Initial feedback from the DORA framework now provides a tangible measure of the scale of digital operational risk. According to the first annual report published in June 2026 by the European Supervisory Authorities (EBA, EIOPA, and ESMA), 3,383 major ICT-related incidents were reported by European Union financial entities.
Approximately one-third of these incidents had a cross-border impact. European authorities further emphasize that system failures and external events constitute the leading causes of reported incidents. Only 10% of the recorded major incidents were directly tied to cybersecurity.
These findings serve as a reminder that operational resilience extends beyond protection against cyberattacks: it must also enable organizations to withstand technical failures and incidents affecting their providers and infrastructure. Concurrently, financial institutions remain exposed to cyber threats such as DDoS attacks, identity theft, data exfiltration, and supply chain attacks.
Furthermore, the ACPR has made DORA implementation a primary focus of its 2026 work program, announcing intensified monitoring of operational risks—particularly IT and cyber risks—as well as outsourcing risks. Digital resilience is thus fully integrated into the governance, risk management, and oversight mechanisms of financial institutions.
Five key pillars for sustainable resilience
To address these challenges, DORA revolves around five key pillars: ICT risk management, incident management and reporting, digital operational resilience testing, ICT third-party risk management, and cyber threat information-sharing arrangements.
Resilience testing occupies a particularly significant place within this framework. For certain financial entities identified according to criteria set out by DORA, this includes Threat-Led Penetration Testing (TLPT), carried out at least every three years.
Each pillar demands tailored technical tools, proven processes, and rigorous documentation. It is precisely in this traceability requirement that one of the main operational challenges lies for teams: ICT risk management frameworks, information registers on third-party providers, incident reports, internal policies, and contractual documentation must all demonstrate the proper application of the regulation's requirements.
In 2026, the challenge is therefore no longer just to prepare for DORA, but to demonstrate the maturity and effectiveness of digital operational resilience frameworks over time.
