DORA Regulation Explained: What Cyprus, Greece and Malta Firms Must Do Now

DORA has applied since 17 January 2025. Its scope comes from Article 2 of Regulation (EU) 2022/2554, including exclusions; the separate simplified framework in Article 16 must also be checked. Location and company size alone do not determine the duties. This guide does not claim knowledge of unpublished CySEC, HCMC or MFSA inspection findings.

Review the five areas against the actual law

• ICT risk management: connect accountable management, policies, assets and recovery arrangements to the applicable provisions.
• Incident management: maintain classification and reporting procedures using the current technical standards and your authority’s instructions.
• Testing: document proportionate tests and remediation; advanced threat-led testing applies to entities identified under the relevant provisions, not every firm.
• ICT third-party risk: maintain the register of information and review contractual arrangements. Distinguish Article 30(2) requirements from the additional requirements in Article 30(3) for critical or important functions.
• Information sharing: Article 45 provides for information-sharing arrangements; do not describe voluntary participation as a universal legal obligation.

Create an evidence index showing the applicable provision, owner, record and unresolved question. Check local submission procedures directly. The oversight penalties for designated critical ICT providers are not a universal fine tariff for all financial firms.

Illustrative product example: reviewing a contract question

A legal reviewer could evaluate Lexis+ for relevant legislation and commentary in the licensed collection, and Lexis+ AI for a cited research answer or first draft where supported. Compare the result manually against the applicable DORA text. This is not automatic Article 30 validation, a register-quality score, incident classification or a compliance certificate.

Official sources and product scope

DORA: Regulation (EU) 2022/2554 · EU overview of DORA

Product references: LexisNexis legal AI (US) · Lexis+ legal research (UK) · Lexis Create+ (US) · Nexis Diligence+ (UK). Product names, features and content vary by edition and market; the site uses its existing product labels. These sources describe product categories, not confirmed local-law coverage.

Reviewed 17 October 2026. Examples are illustrative evaluation scenarios, not customer case studies. General information, not legal advice. Check current consolidated law, technical standards and competent-authority instructions before relying on a rule. Confirm jurisdiction, language, content licence, feature availability and security terms in the proposed subscription. Software does not certify regulatory compliance.

Discuss your team’s next step

Tell us your jurisdiction and one priority task. Request a 30-minute product walkthrough using public or anonymised material; do not send confidential client documents with your enquiry. We will scope the relevant research, drafting or due-diligence demonstration and confirm coverage and limitations.

Request a tailored demo