[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Feu-dora-financial-ict-risk-quantum":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Feu-dora-financial-ict-risk-quantum.md","EU DORA Governs Financial Firms' Technology Risk and Pulls Cryptography Into Scope","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"eu-dora-governs-financial-firms-technology-risk","EU DORA governs financial firms' technology risk",[18,19,20],"p",{},[21,22,23],"strong",{},"17 JANUARY 2025, BRUSSELS",[18,25,26],{},"The EU Digital Operational Resilience Act, known as DORA, entered into force on 16 January 2023 and has applied to financial firms since 17 January 2025. It builds on four pillars, one of which is ICT risk management. DORA sets no post-quantum deadline of its own, so it does not name a date by which firms must adopt quantum-resistant cryptography.",[18,28,29],{},"Cryptography still enters the regulation. Article 9 and the delegated technical standards that sit beneath DORA cover encryption and key management, and a recital references quantum. That structure lets supervisors treat cryptographic resilience as part of a firm's ICT risk management, using DORA as the legal anchor rather than pointing to a standalone quantum rule.",[18,31,32],{},"Because DORA frames the obligation through risk management rather than a fixed deadline, firms carry the responsibility to assess their own cryptographic exposure and act on it. A supervisor can ask a firm how it manages the risk that today's cryptography becomes vulnerable, and expect a credible answer grounded in the technical standards.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," DORA gives European supervisors a standing legal hook for cryptographic resilience without waiting for a dedicated quantum regulation. Financial firms that treat post-quantum readiness as part of their ICT risk management, with an inventory and a migration plan, are better placed to answer supervisory questions. The absence of a hard deadline is not an absence of expectation.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Policy","2025-01-17","The EU Digital Operational Resilience Act applies to financial firms since January 2025; cryptography enters via Article 9 and delegated technical standards.",false,"md",[49,52,55],{"q":50,"a":51},"Does DORA set a post-quantum deadline?","No. DORA sets no post-quantum deadline of its own. Cryptography enters its scope through Article 9 and the delegated technical standards, and a recital references quantum, so supervisors use DORA as the legal anchor for cryptographic expectations rather than a dated mandate.",{"q":53,"a":54},"When did DORA start to apply?","DORA entered into force on 16 January 2023 and has applied to financial firms since 17 January 2025. Its four pillars include ICT risk management, which is where cryptographic requirements sit for in-scope firms across the European Union.",{"q":56,"a":57},"Who does DORA cover?","DORA covers a broad range of financial entities in the European Union, from banks and insurers to investment firms and certain ICT providers that serve them. The regulation makes technology risk, including cryptography, a supervised matter for those entities.",[59],"brussels","\u002Fassets\u002Fog-default.png",[62,63],"Financial Services","Cross-Sector",{},"2026-09-01",true,"\u002Fnews\u002Feu-dora-financial-ict-risk-quantum",[69],{"label":70,"url":71},"European Union, \"Regulation (EU) 2022\u002F2554 on digital operational resilience for the financial sector (DORA),\" Official Journal of the European Union, Dec. 27, 2022.","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj",[73,76],{"label":74,"url":75},"EU Technical Standard 2024\u002F1774 Requires Crypto Updates as Attacks Advance","\u002Fnews\u002Feu-technical-standard-2024-1774-crypto-updates",{"label":77,"url":78},"G7 Financial-Sector Post-Quantum Roadmap Targets 2030 to 2032","\u002Fnews\u002Fg7-financial-sector-post-quantum-roadmap-2030-2032",{"title":5,"description":45},"EU DORA Governs Financial Firms' Tech Risk","eu-dora-financial-ict-risk-quantum","news\u002Feu-dora-financial-ict-risk-quantum",[84,85,86,87,88],"DORA","financial services","federal compliance","crypto-agility","for enterprises","The EU Digital Operational Resilience Act has applied to financial firms since January 2025, and cryptography enters its scope through Article 9 and delegated technical standards.","70Pmord3zNJdkX_4OIUsHci0mxDWF-HAb8WGJDU3Byg",1792182886773]