DORA vs NIS2: Dual Compliance Without Doubling the Work
Many compliance teams in the EU financial sector are now looking at two major regulations at the same time. DORA came into force in January 2025. NIS2 national transpositions are either live or arriving. This is not a coincidence.
Both regulations respond to the same underlying reality. Digital systems are now the backbone of critical services. Regulators across the EU want those systems to be resilient. The question for your compliance team is not whether to comply with both. The question is how to do it without running two separate programmes in parallel.
Who DORA Covers
DORA applies to financial entities operating in the EU. The list in Article 2 is long: banks, payment institutions, electronic money institutions, investment firms, crypto asset service providers, insurance and reinsurance undertakings, pension funds, credit rating agencies, and more. Supervision is handled by financial regulators including the ECB, EBA, ESMA, and national competent authorities depending on the entity type. If your organisation is in the financial sector, you almost certainly fall under DORA.
Who NIS2 Covers
NIS2 casts a wider net. It applies to essential and important entities across 18 sectors, and financial services is one of them. Banks and financial market infrastructure operators are listed explicitly as essential entities under NIS2. Supervision under NIS2 falls to national cybersecurity authorities. In Germany that is BSI, in France it is ANSSI, in Norway it is NSM. Each country has its own designated authority, which means the enforcement experience varies across the EU.
The Key Legal Point: DORA Is Lex Specialis
This is where things get interesting, and where a lot of the dual compliance anxiety is unnecessary.
NIS2 Article 4 contains an explicit carve-out. Where a sector-specific EU act imposes requirements on network and information security that are equivalent to or stricter than those in NIS2, that sector-specific act takes precedence. For financial entities, DORA is that act.
What this means in practice is straightforward. Your DORA compliance largely satisfies your NIS2 obligations. The word "largely" is doing real work in that sentence. There are areas where NIS2 goes beyond DORA, and you need to know where those are. But the starting point is that a solid DORA programme gets you most of the way there.
Where the Two Regulations Overlap
The overlap between DORA and NIS2 is substantial. Working through your DORA requirements in any of the following areas simultaneously ticks NIS2 boxes.
ICT Risk Management
Both regulations require a documented risk management framework. DORA Articles 5 to 14 set out detailed requirements for identifying, protecting against, detecting, responding to, and recovering from ICT risks. NIS2 Article 21 requires essentially the same thing. A single risk framework built to DORA standards meets both.
Incident Reporting
DORA sets out a structured incident reporting regime with specific timelines: initial notification, intermediate report, and final report. NIS2 Article 23 requires a similar three-stage reporting process for significant incidents. The timelines are not identical, but the underlying process is the same. One incident response workflow, documented and tested, covers both regulations.
Third-Party and Supply Chain Oversight
DORA Chapter V is dedicated to ICT third-party risk. You need a register of ICT service providers, due diligence processes, contractual requirements, and exit strategies. NIS2 Article 21(d) requires measures to address supply chain security. Again, the DORA work covers the NIS2 requirement for financial entities.
Business Continuity
DORA Article 11 requires business continuity plans, backup procedures, and recovery testing. NIS2 Article 21(c) requires business continuity measures including backup management and disaster recovery. If your BCP programme is built to DORA standards, it satisfies NIS2 at the same time.
If you use DORA GRC, you can activate the NIS2 framework alongside DORA and see your requirements side by side in the compliance tracker. Each NIS2 requirement shows which DORA articles it cross-references, so you can see exactly where you stand without manually maintaining a crosswalk spreadsheet.
Where NIS2 Goes Beyond DORA
Despite the broad overlap, there are three areas where NIS2 imposes obligations that DORA does not directly address. These are the gaps worth tracking.
1. Registration with National Authorities
NIS2 requires essential and important entities to register with their national NIS2 competent authority. This includes providing basic information about the organisation and its services. DORA does not have an equivalent registration requirement. You may already be known to your financial supervisor, but NIS2 requires a separate registration step with a different authority. Check whether your national transposition has gone live and what the registration deadline is.
2. Supply Chain Risk Assessments at EU Level
NIS2 Article 22 introduces a mechanism for coordinated security risk assessments of critical ICT supply chains at the EU level. These assessments are conducted by ENISA and the NIS Cooperation Group. They can result in recommendations that apply to essential entities across sectors. This is broader than DORA's third-party oversight framework, which focuses on your own contractual relationships with providers. You should monitor ENISA publications and any resulting guidance from your national authority.
3. Management Body Training and Accountability
NIS2 Article 20 is explicit. Members of the management body must follow specific cybersecurity training. They must also approve the organisation's cybersecurity risk management measures and can be held personally liable for infringements. DORA has training obligations and governance requirements, but the framing is different. DORA focuses on the management body approving the overall ICT risk framework. NIS2 goes further by requiring documented evidence that individual members have completed relevant training. This is worth a specific action item in your governance programme.
Running One Programme, Not Two
The practical answer to dual compliance is straightforward. Do not build two parallel programmes. Build one programme and map it to both frameworks.
That means one risk framework, documented once, mapped to both DORA and NIS2 requirements. One incident response process with timelines that satisfy both reporting regimes. One third-party register used for both DORA third-party risk management and NIS2 supply chain security. One policy library that references both sets of obligations where relevant.
The mapping work is a one-time investment. Once you have documented which DORA controls satisfy which NIS2 requirements, you maintain that mapping as you update your controls. The three NIS2-specific gaps described above can be tracked as additional items within the same system.
A compliance tool that supports multiple frameworks makes this significantly easier. Rather than maintaining a separate spreadsheet to track the crosswalk, you can manage DORA and NIS2 requirements in the same place, with the relationships already built in.
The place to start is your existing DORA programme. If it is reasonably complete, you are already most of the way there. Audit your current controls against the NIS2 requirements, identify the gaps, and address them as targeted additions rather than a second programme from scratch.
Closing Thoughts
The overlap between DORA and NIS2 is a feature of how EU regulation is designed, not a problem that compliance teams created. The lex specialis principle in NIS2 Article 4 exists precisely to avoid regulatory duplication for financial entities.
If your DORA programme is solid, you are most of the way there for NIS2. The remaining gaps are manageable once you know where they are. Registration with your national authority, awareness of EU-level supply chain assessments, and management body training are specific, concrete actions. None of them requires rebuilding your compliance programme from the ground up.
The goal is one programme that is coherent, well-documented, and evidenced. That programme happens to satisfy both DORA and NIS2, because both regulations are ultimately asking for the same thing: an organisation that takes digital resilience seriously.
For a broader look at which EU regulations apply to your organisation, see EU CRA, NIS2, DORA, EU AI Act: Which Regulation Applies to You?