Deloitte Survey Examines DORA Compliance Progress Across 13 European Countries

Key Takeaways

• European DORA Assessment: Deloitte surveyed 50 financial entities across 13 European countries in February 2026 to examine compliance readiness and implementation challenges.
• Compliance Timelines: The research examines when institutions expect to achieve full DORA compliance, with results organized by legal entity type.
• Third-Party Incident Reporting: Deloitte investigates the timeframes institutions have agreed with technology suppliers for receiving ICT incident notifications.
• Supplier Oversight and Software Security: On-site inspections of third-party providers and the use of software bills of materials are among the practices examined.
• Research Limitations: Deloitte cautions that its February 2026 findings may not represent all financial entities subject to DORA or reflect subsequent developments.

Deep Dive

More than a year after the European Union's Digital Operational Resilience Act took effect, Deloitte surveyed 50 financial entities across 13 countries to examine when they expected to achieve full compliance with the regulation.

The question was one of several posed in February 2026 as part of a European assessment of DORA implementation. Published on June 8, the research examines compliance readiness alongside the arrangements financial institutions have made with technology suppliers, including how quickly those suppliers must report incidents and whether institutions conduct on-site inspections.

DORA has applied since January 17, 2025, imposing common requirements for managing information and communication technology risks across much of Europe's financial sector. Its provisions cover incident reporting, resilience testing and oversight of external technology providers, among other responsibilities.

For financial institutions, compliance requires more than securing their own systems. They must also manage risks arising from technology services supplied by other companies, including those supporting critical business functions. Deloitte's survey concentrates on several practical aspects of that responsibility, where an institution's ability to meet its obligations may depend on information or access provided by a supplier.

The research examines anticipated compliance dates by legal entity type, allowing Deloitte to consider differences among the institutions covered by the regulation. It also collects information about participants' customer bases and revenue distribution.

The published survey summary does not establish how many respondents had achieved full compliance when the research was conducted. Nor does it provide sufficient numerical detail to determine which types of institution were furthest along.

That distinction matters. DORA's application date has passed, but an institution's expectation of reaching full compliance at a later date does not, by itself, establish a regulatory breach. The survey measures participants' reported positions rather than presenting the findings of supervisory examinations.

The Demands of Third-Party Oversight

One of the survey's principal subjects is the timeframe financial institutions have agreed with external technology providers for receiving notifications of ICT incidents.

The arrangement can become consequential when a disruption originates outside an institution's own systems. A financial entity may be responsible for assessing and reporting a serious incident even though the affected infrastructure belongs to a supplier. Its ability to establish what happened, determine the operational consequences and meet applicable reporting deadlines may depend on how promptly that supplier provides information.

DORA requires financial institutions to maintain processes for managing ICT-related incidents and reporting those classified as major. It also establishes requirements for contractual arrangements with ICT third-party service providers.

Deloitte's examination of notification timeframes addresses the connection between those responsibilities. A financial institution cannot make an informed assessment of a supplier-related incident without obtaining the relevant facts, and contractual reporting arrangements can affect how quickly those facts become available.

The survey also investigates on-site inspections of technology providers, an area where the requirements of financial institutions must be reconciled with the operations of companies serving multiple customers.

DORA requires certain contractual arrangements for ICT services supporting critical or important functions to include access, inspection and audit rights. Those provisions are intended to give financial institutions the means to examine risks associated with outsourced technology services.

Exercising such rights can involve considerable practical work. Institutions must determine what evidence they need, how it can be obtained and whether the information provides sufficient assurance about the services on which they depend.

The Deloitte summary identifies on-site inspections as a subject of the research but does not specify how many respondents conduct them or how frequently they take place.

The attention given to supplier notification arrangements and inspections is significant for another reason. Financial institutions remain responsible for managing ICT third-party risk under DORA even when they have entrusted important technology functions to outside companies. Outsourcing a service does not remove the obligation to oversee the risks associated with it.

Understanding the Software Beneath the Service

Deloitte also examines the use of software bills of materials, commonly known as SBOMs, which provide information about the components contained in software products. Such inventories can help institutions and their suppliers identify potentially affected systems when vulnerabilities are discovered in software components. A flaw in a widely used library, for example, may require an institution to determine whether the component is present in applications it operates or obtains from external providers.

That assessment can be difficult when information about the composition of software is incomplete or held elsewhere in the supply chain.

SBOMs can assist with this work, although they are not a universal standalone requirement under DORA. Their relevance to the regulation lies in the broader obligation to identify and manage ICT risks, including risks associated with software dependencies.

The survey's inclusion of SBOMs places software transparency alongside more established questions about contractual oversight and incident reporting. All concern the information financial institutions need to understand the technology supporting their operations.

Deloitte does not disclose the rate of SBOM adoption in the narrative accompanying its published survey graphics, leaving the extent of their use among respondents unclear.

The firm describes the research as an examination of the difficulties institutions encounter when implementing DORA, with the aim of identifying approaches that may improve compliance and operational resilience.

Its conclusions must be considered within the survey's stated limits. Deloitte cautions that the findings reflect responses collected in February 2026 and may not account for subsequent developments. The 50 participating financial entities also may not be representative of all institutions subject to the regulation.

Even within those limits, the subjects Deloitte chose to investigate illustrate the considerable operational work involved in implementing DORA. Incident reporting depends on timely information, supplier oversight requires access to evidence, and software risk assessments benefit from an understanding of components that may sit several layers below the services an institution purchases.

These responsibilities extend into procurement, contractual management, technology operations and risk oversight. They also require continuing attention as institutions change suppliers, introduce new systems and encounter vulnerabilities or disruptions.

DORA provides the regulatory framework for that work. Financial institutions must maintain the arrangements needed to meet its requirements, including the means to obtain information from outside providers when circumstances demand it. For those dependent on critical external technology services, the effectiveness of those arrangements may become apparent only when a disruption occurs and the institution needs answers quickly.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey