NIS2, DORA overlap
NIS2 or DORA: which one applies to a financial entity?
Banking and financial market infrastructure are listed in Annex I of NIS2. Yet a bank does not implement NIS2 for its cybersecurity: it applies DORA. The rule fits in two articles, but its edges matter.
By Younes Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .
The rule: DORA prevails
Article 4(1) of NIS2 disapplies its own provisions, supervision under Chapter VII included, where a sector-specific act imposes cybersecurity risk-management or incident-reporting requirements of at least equivalent effect.
Article 1(2) of DORA settles the point for finance: for financial entities identified as essential or important under NIS2, DORA is that sector-specific act.
Where the rule stops
Entities not covered
Article 4(1) of NIS2 states that the Directive keeps applying to entities in a sector that the sector-specific act does not cover.
Mixed groups
A subsidiary providing digital or infrastructure services outside the financial perimeter may fall under NIS2 for that activity.
ICT providers
A bank's cloud provider may itself be a NIS2 entity (digital infrastructure) while bound by DORA Article 30 clauses through its contracts.
Quick comparison
| Topic | NIS2 | DORA | Source |
|---|---|---|---|
| Legal form | Directive, transposed by each Member State | Regulation, directly applicable since 17 January 2025 | Regulation (EU) 2022/2554, Article 64 |
| Risk management | Article 21 | Articles 5 to 16 | Directive (EU) 2022/2555, Article 21 |
| Incident reporting | Early warning within 24 hours, notification within 72 hours | 4 hours after classification, 24 hours at most | Delegated Regulation (EU) 2025/301, Article 5 |
| Third parties | Supply chain security (Article 21(2)(d)) | Register and mandatory clauses (Articles 28 and 30) | Regulation (EU) 2022/2554, Articles 28 and 30 |
What this means for you
- A financial entity builds its framework on DORA.
- Each non-financial subsidiary needs its own NIS2 assessment.
- Your providers may be under NIS2 and your DORA clauses at once.
Map your group
A first call allocates the entities in your group between DORA, NIS2 or neither.
Book a callFrequently asked questions
Is a bank a NIS2 entity?
Banking is listed in Annex I of NIS2, but Article 1(2) of DORA makes DORA the sector-specific act, so NIS2 risk-management and reporting obligations give way to DORA.
Do NIS2 authorities supervise financial entities?
Article 4(1) of NIS2 also disapplies the supervision and enforcement provisions of Chapter VII for entities covered by the sector-specific act. The financial authority supervises under DORA.
What this regime triggers elsewhere
ICT register, contracts and incidents.
DORAScope and transposition.
NIS2The industry view for fintechs.
DORA for fintechsAbout the author
Younes Lahrach is the founder and director of Sila International Advisory. A GDPR legal consultant and external data protection officer since July 2025, he holds a Master's degree (M2) in European Union law, specialising in data protection, from the University of Lille, and an MBA in International Finance from Middlesex University. He is a legal consultant, not a lawyer (avocat).
His background →Reference texts
The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.