DORA Training for Financial Entities in Ireland: What the Regulation Says

DORA training for financial entities is built into the Digital Operational Resilience Act, Regulation (EU) 2022/2554. The Regulation does not just ask firms to have good IT security. It gives the management body responsibility for ICT risk, refers to ICT security awareness programmes and digital operational resilience training for staff, and says members of the management body must keep their own knowledge up to date. According to the Central Bank of Ireland, DORA has been in application since 17 January 2025. This guide sets out what we could confirm from EU and Central Bank sources, and where we could not.

Who DORA applies to and who oversees it in Ireland

Article 2(1) of DORA lists the entities it applies to, including credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, managers of alternative investment funds, management companies, insurance and reinsurance undertakings, insurance intermediaries, crowdfunding service providers and ICT third-party service providers. EIOPA describes this as 20 different types of financial entities and ICT third-party service providers. Article 4(1) says financial entities implement the ICT risk rules in accordance with proportionality, taking account of size, overall risk profile and the nature, scale and complexity of services, activities and operations.

The Central Bank says DORA applies to a wide range of financial entities that it regulates, and its FAQ says scope depends on the type of entity, not the activity. The FAQ adds that some smaller entities are out of scope, that microenterprises have some relief, and that for passporting entities, with Ireland as host country, DORA requirements are supervised by the home-country competent authority responsible for prudential supervision. The Central Bank receives reports of major ICT-related incidents from entities in its remit through its portal. Its industry briefing slides carry a footnote that certain credit institutions (marked "SI") are supervised by the ECB. The Central Bank DORA page refers to "relevant supervisory authorities", and the FAQ refers to the "Competent Authority (CA) responsible for prudential supervision" in the home country for passporting entities, so check the current position for your firm type.

The Central Bank FAQ also says DORA does not provide for a transitional period. For a broader view of related security training for finance teams, see our guide to cybersecurity training for finance professionals.

What DORA says about the management body

Article 5(2) says the management body "shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework". Among its listed duties, point (g) is to "allocate and periodically review the appropriate budget to fulfil the financial entity's digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff".

Article 5(4) is about the management body's own knowledge. It says members of the management body "shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed".

Article 13(6): awareness programmes and resilience training

Article 5(2)(g) cross-refers to Article 13(6). We could not open the text of Article 13(6) itself on EUR-Lex because the page was truncated in our tools, so we do not quote it. What we can report comes from the cross-reference above and from EIOPA's published Q&A (DORA 250-3380, submitted 9 July 2025, status final). EIOPA says Article 13(6) makes ICT security awareness programmes and digital operational resilience training compulsory parts of staff training. It says the Article does not set a fixed training frequency. Training should match each person's role, and under proportionality each entity should set the frequency and periodic updates in its own programme. EIOPA adds that entities should use lessons from ICT-related incident analysis and relevant cyber threat intelligence when updating the programmes. The answer did not address ICT third-party service providers. Check the Regulation text directly for the exact wording.

Commission Delegated Regulation (EU) 2024/1774, which supplements DORA on ICT risk management tools, methods, processes and policies, contains related wording in its simplified framework. In the text we read, Article 28(2)(e) refers to the management body allocating and reviewing at least once a year the budget for resources including ICT security awareness programmes, digital operational resilience training and ICT skills for all staff. We read this only in excerpt, so confirm whether it applies to your entity.

Required, explained or suggested?

A practical approach

Our suggestions, which are not legal requirements:

• Keep a written training plan that shows who is covered (board, senior management, staff in ICT and operations roles, other staff) and why the content suits each group.
• Record attendance and completion so the management body can show that it reviewed the budget and the programme.
• Feed lessons from incidents and threat intelligence into updates, as EIOPA's answer suggests.
• Link training to your incident reporting process. The Central Bank says the obligation to report major ICT-related incidents has applied since 17 January 2025, so staff need to know how to escalate.
• Dublin-based teams may find it useful to align DORA training with other professional development; see our overview of CPD training for finance professionals in Dublin. DORA is an EU Regulation, so the rules do not differ by city.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

When did DORA start to apply?

The Central Bank and EIOPA both say DORA has been in application since 17 January 2025. The Central Bank says it was published in the Official Journal on 27 December 2022.

Does DORA require board members to be trained?

Article 5(4) says members of the management body must actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including by following specific training on a regular basis, commensurate to the ICT risk being managed. It does not set a number of hours.

How often must DORA training take place?

EIOPA's Q&A says Article 13(6) does not set a fixed frequency, and that each entity should set it under proportionality, matched to roles. The Delegated Regulation excerpt we read refers to an annual review of the budget, which is different from a training interval.

Does DORA apply to small firms?

The Central Bank FAQ says scope depends on entity type, certain smaller entities are out of scope and microenterprises have some relief. Article 4(1) applies proportionality. Check the Regulation and the Central Bank FAQ for your entity.

The legal text points to management body accountability, regular training and proportionality. A documented, role-based programme is our suggestion, not a legal requirement.