DORA Applies to You.
Is Your ICT Resilience Provable?

No. DORA is an EU regulation, not a directive, so it has applied directly in Sweden since 17 January 2025 without needing a separate transposition law. Lag (2024:1278) supplements it with Sweden-specific supervision and penalty detail but does not create the underlying obligations.

Likely yes. DORA’s scope is broad and covers most regulated financial entities regardless of size. Microenterprises (fewer than 10 staff, turnover or balance sheet under €2 million) get reduced obligations in several places – a lighter risk-framework review cycle, no mandatory TLPT, more flexible testing – but incident reporting and third-party contract requirements still apply in full. The gap score includes a scope determination.

Yes, potentially. If you support a critical or important function for a financial entity, DORA reaches you through the mandatory contract clauses your customer must now put in place. Providers judged systemically important can also be designated Critical ICT Third-Party Providers under direct EU-level oversight.

A documented, board-approved ICT risk management framework with clear accountability at management-body level: an ICT risk appetite, ongoing asset identification and protection and a strategy for detection, response and recovery. The management body carries ultimate responsibility and must maintain up-to-date knowledge of ICT risk.

Late reporting is a compliance failure in its own right. Article 19 requires an initial notification within 4 hours of classification (24-hour backstop from detection), an intermediate report within 72 hours and a final report within one month. eBuilder’s SOC timestamps incidents from first detection to help your team meet all three.

Every contract supporting a critical or important function needs audit rights, security requirements, incident-notification obligations and exit provisions. You also need a Register of Information covering all ICT third-party arrangements, submitted to Finansinspektionen annually. eBuilder’s CISO Advisory helps keep that register current.

Only if Finansinspektionen designates your organisation “significant.” If so, TLPT is required at least every three years under the TIBER-SE framework by testers meeting Article 27’s qualifications. Every in-scope entity still needs an annual baseline testing programme regardless.

Yes. Under Lag (2024:1278), individuals can face a sanction fee up to €500,000 or three times their personal profit from the breach and for serious, intentional or grossly negligent breaches, a 3 - 10 year ban from board or CEO roles at a financial entity.

Finansinspektionen can impose a sanction fee up to the highest of roughly €1 million, 10% of your prior-year turnover or three times the profit gained from the breach for a legal-person financial entity under Lag (2024:1278).

Yes. DORA has applied directly since 17 January 2025 and Finansinspektionen is Sweden’s competent authority for it, supplemented by Lag (2024:1278). Supervision is active now, not at a future date.

Not automatically. DORA takes precedence over NIS2 for financial entities and adds requirements neither NIS2 nor GDPR cover: a Register of Information, TLPT for significant entities and DORA-specific incident-classification thresholds. A cybersecurity incident involving personal data can still trigger a separate GDPR notification duty at the same time.

DORA takes precedence over NIS2 for financial entities; it is sector-specific legislation covering the same ICT-risk ground in more detail. Our CISO Advisory service can address both through a combined programme where a group also has non-financial entities in scope of NIS2.

Our CISO Advisory service helped a Stockholm-based fintech complete DORA scope mapping, define incident-classification thresholds and design its reporting workflow within a single working week. Full alignment timelines depend on your starting point. The gap score gives you a specific starting point before you commit to anything.

Yes. eBuilder’s MDR/SOC and CISO Advisory extend your existing team’s capability rather than replacing it, integrating with your current tooling and providing the always-on monitoring and governance support DORA expects.