LexLint.ioBeta

Know the law your code answers to.

Law / Ireland

European Union (Digital Operational Resilience) (No. 2) Regulations 2025, Competent Authority and Sanctions

S.I. No. 20 of 2025, regs. 3 to 7

In force since .

A sector security regimes rule binding public and private bodies.

Private right of action
No
Obligation class
Security, Governance

As of .

What it requires

  • If you are a financial entity in Ireland that falls under the DORA Regulation, comply with it and with these Regulations; credit unions are outside both until (regulations 2 and 3).
  • Stop conduct that breaches the DORA Regulation when the Central Bank orders you to cease and desist, and do not repeat it (regulation 6(4)(a)).

These lines are LexLint's reading of the law's text, as of .

In the frameworks

NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

Enforcement body

The Central Bank of Ireland, designated by regulation 4 as the competent authority in the State for Articles 26(9) and 32(5) of the DORA Regulation.

Settledness

As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Central Bank of Ireland is designated as the competent authority in the State for Articles 26(9) and 32(5) of the DORA Regulation (regulation 4). The Bank has all the powers necessary for its functions and duties under the DORA Regulation (regulation 5).

For a contravention of the DORA Regulation the Bank may order the person to cease and desist, order the cessation of a practice, adopt measures including pecuniary measures to ensure financial entities continue to comply, and issue public notices naming the person and the breach, and it may apply the sanctions to members of the management body (regulation 6). Any decision taken or sanction imposed is an appealable decision under Part VIIA of the Central Bank Act 1942 (regulation 7). The DORA Regulation and these Regulations do not apply to credit unions until (regulation 3).

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app