EU DORA governs financial firms' technology risk
17 JANUARY 2025, BRUSSELS
The EU Digital Operational Resilience Act, known as DORA, entered into force on 16 January 2023 and has applied to financial firms since 17 January 2025. It builds on four pillars, one of which is ICT risk management. DORA sets no post-quantum deadline of its own, so it does not name a date by which firms must adopt quantum-resistant cryptography.
Cryptography still enters the regulation. Article 9 and the delegated technical standards that sit beneath DORA cover encryption and key management, and a recital references quantum. That structure lets supervisors treat cryptographic resilience as part of a firm's ICT risk management, using DORA as the legal anchor rather than pointing to a standalone quantum rule.
Because DORA frames the obligation through risk management rather than a fixed deadline, firms carry the responsibility to assess their own cryptographic exposure and act on it. A supervisor can ask a firm how it manages the risk that today's cryptography becomes vulnerable, and expect a credible answer grounded in the technical standards.
Why it matters. DORA gives European supervisors a standing legal hook for cryptographic resilience without waiting for a dedicated quantum regulation. Financial firms that treat post-quantum readiness as part of their ICT risk management, with an inventory and a migration plan, are better placed to answer supervisory questions. The absence of a hard deadline is not an absence of expectation.