Regulations

DORA, the GDPR, NIS2 and MiCA — who they apply to and what they require

Each one reaches a company by a different route: DORA and MiCA through financial market supervision, NIS2 through the national cybersecurity act, the GDPR directly. For each you will find the scope, the obligations with article numbers, and what a customer or a supervisor asks about first.

Book a 4-week pilot

DORA

DORA: who it applies to and what it requires

DORA — the Digital Operational Resilience Act, Regulation (EU) 2022/2554 — has applied since 17 January 2025 to financial entities in the EU: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and others. It requires an ICT risk management framework, incident reporting, resilience testing and tight management of ICT vendors — and that last pillar is how it reaches software and IT companies.

DORA for ICT vendors

DORA for ICT vendors: what lands in your contract

If your customer is a bank, an insurer, an investment firm, a fund manager, a payment institution or a crypto-asset service provider in the EU, DORA reaches you as an ICT third-party service provider (Art. 3(19)) through the contract: your customer has to include the Art. 30 clauses, list your service in the register of information (Art. 28(3)) and assess you before and during the relationship. The supervisor does not oversee you — but you can lose the contract.

GDPR

GDPR for a software company: what customers will ask for

The GDPR — Regulation (EU) 2016/679 — applies to every company processing the personal data of people in the EU, from a two-person SaaS to a bank. For a software vendor the practical obligations are a legal basis and a privacy notice for your own processing (Art. 6, 13–14), a record of processing activities (Art. 30), security measures (Art. 32), breach handling (Art. 33–34) and — where you process on behalf of customers — an Art. 28 data processing agreement.

NIS2

NIS2: essential or important entity — and what it requires

NIS2 — Directive (EU) 2022/2555 — applies to medium and large entities in the Annex I sectors (essential: energy, transport, banking, health, digital infrastructure, ICT service management, public administration, space and others) and the Annex II sectors (important: postal services, waste, chemicals, food, manufacturing, digital providers, research). It requires ten risk management measures (Art. 21), incident reporting within 24 and 72 hours (Art. 23) and management accountability (Art. 20). Poland implements it through the amended National Cybersecurity System Act (KSC).

MiCA

MiCA: crypto-asset service providers, issuers and white papers

MiCA — the Markets in Crypto-Assets Regulation, (EU) 2023/1114 — regulates offering crypto-assets to the public and providing crypto-asset services in the EU. Issuers and offerors need a compliant white paper (Art. 6); crypto-asset service providers need an authorisation (Art. 59) and have to meet conduct, prudential, custody and complaint-handling rules. CASPs are also financial entities in the sense of DORA.

Not sure which one applies to you?

Six yes/no questions tell you which regulations probably apply to you, and cite the article to check. We store nothing.

Book a 4-week pilot