DORA in Practice: What Insurers and IT Service Providers Really Need to Consider in 2026
Since 17 January 2025, the Digital Operational Resilience Act (DORA) has applied directly in all EU member states. For banks, insurance companies, payment service providers, and other financial undertakings, this marked the end of a multi-year preparation phase. However, in 2026, the nature of the regulation has noticeably changed: pure documentation obligation has become active supervision. BaFin has unequivocally declared 2026 a test of endurance – the focus is no longer on whether DORA has been implemented, but how stringently.