What is DORA and who does it apply to?

DORA (EU Regulation 2022/2554) is a binding EU law that took effect in January 2025. It applies to financial institutions operating in or serving the European Union—including banks, insurers, investment firms, and payment providers—as well as the ICT third-party providers supplying them. Its five pillars cover ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing.

Does DORA apply to software vendors outside the EU?

Yes. If your software or services are used by EU-regulated financial institutions, you fall within DORA's third-party ICT provider scope under Articles 28-44, regardless of where your company is headquartered. Any vendor in the software supply chain of an EU financial institution should review their DORA obligations, particularly around contractual requirements, audit rights, and supply chain transparency.

What are the penalties for DORA non-compliance?

Financial institutions found non-compliant face fines of up to 2% of total annual worldwide turnover. Critical ICT third-party providers can face penalties up to €5 million. Beyond financial penalties, regulators can require firms to suspend or terminate contracts with non-compliant ICT providers, making DORA exposure a severe commercial risk, not just a compliance risk. Note: exact penalty structures can vary by Member State enforcement; always consult legal counsel.

Why do AI coding agents create a specific DORA compliance problem?

DORA was designed around human-gated development processes where every change traces back to a named, accountable person. AI coding agents break that accountability chain by committing, building, and promoting artifacts autonomously. They pull dependencies without policy review, generate code with vulnerability classes legacy scanners miss, and produce no audit trail by default, leaving organizations unable to satisfy DORA's evidence requirements on demand.

What is DevGovOps and how does it address DORA?

DevGovOps is a Software Supply Chain Engineering practice that embeds continuous governance and compliance into the software delivery lifecycle. Rather than assembling compliance evidence after the fact, DevGovOps generates cryptographic attestations, enforces policy-as-code gates, and maintains a unified system of record automatically at every pipeline stage. For DORA specifically, it ensures that the evidence regulators require exists at the moment each decision is made, not weeks later.

How long does it take to produce DORA audit proof with and without DevGovOps?

According to the JFrog 2026 Software Supply Chain Security State of the Union, 48% of organizations need a week or more to produce compliance audit proof when asked, and only 6% can do it in under a day. With a DevGovOps approach, evidence is generated automatically at every pipeline run and is retrievable on demand, replacing multi-week manual assembly exercises with proof that already exists.

From the Frog's mouth

All Blogs

Security

DevOps

AI/ML

IoT

Cloud

Industries

Integrations & Partners

News & Community

GRC

swampUP 2026 Preview: The Trust Layer for the Agentic Software Supply Chain

August 4, 2026 Sean Pratt, Senior Manager, JFrog | 5 min read

Malicious packages and AI assets have grown 7.4x in the last three years. And yet, four out of five enterprises have no governance framework for coding agents. The software supply chain has become agentic, yet most enterprises are still securing and governing it with the manual systems from the last era. This moment requires a…

Agentic Development Security is a Discipline that Starts Before the First Line of Code

August 6, 2026 Ohad Shalev | 7 min read

Ask most security tools what an AI coding agent just built, and they can tell you. Ask what it was allowed to consume before it started, and far fewer have an answer. That gap, between watching agentic development and controlling it, is what securing it actually comes down to. Securing agentic development means stopping risk…

How to Control AI Assets Before They Become Shadow AI

July 29, 2026 Or Cohen Naznin, Product Manager, JFrog ML | 5 min read

A developer on your team just told Claude Code to connect to a new MCP server, the protocol coding agents use to reach organizational tools and data. Nobody in security reviewed it. Nobody in security even knows it happened. For two-thirds of enterprises, the primary obstacle to scaling agentic development isn’t budget or headcount —…

Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings

July 27, 2026 Yoav Landman, JFrog CTO | 5 min read

UPDATE August 5, 2026: This week at Black Hat USA, the OpenAI team presented a detailed reconstruction of the chain of events behind the Hugging Face incident. I was glad to watch OpenAI speaking openly about it. This kind of transparency reflects the same spirit of collaboration we experienced working with their team behind the…

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

July 21, 2026 Guy Korolevski, JFrog Security Researcher | 14 min read

The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix. This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results…

Secure AI Workflows: The Identity and Access Management (IAM) Checklist

July 8, 2026 Mika Lanir, JFrog Technical Writer Sean Pratt, JFrog Director of Product Marketing | 6 min read

AI agents and LLMs are already building, analyzing, and deploying code across your software development lifecycle. As software supply chains become increasingly AI-driven, proactive security and access controls are your only path to success. To effectively govern authentication and permissions without sacrificing development speed, you must update your access management strategies. By securing the AI…

Beyond Tokens SF: Best Ideas of the Evening

July 7, 2026 The JFrog Team | 5 min read

AI agents are changing how software gets built, but the infrastructure around them hasn't caught up. Agents burn through tokens on noise. They take actions they shouldn't. Context evaporates between releases. And most delivery pipelines were never designed for the pace and volume of agentic development. On June 11th we brought together developers in San…

Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

July 1, 2026 Tamir Friedman, JFrog Security Researcher Ofri Ouzan, JFrog Security Researcher | 11 min read

At JFrog, our Security Research team continuously monitors and analyzes newly disclosed CVEs across the open-source ecosystem. Throughout our research, we have repeatedly observed cases where the assigned severity score does not accurately reflect a vulnerability's real-world impact or exploitability. In fact, during 2025, JFrog researchers reassessed NVD critical-severity vulnerabilities and concluded that 96% warranted…

JFrog Named a Leader in the Inaugural Gartner^® Magic Quadrant™ for Software Supply Chain Security

June 18, 2026 The JFrog Team | 5 min read

The recognition is new; the commitment behind it isn't. It's official. Gartner just published the very first Gartner® Magic Quadrant™ for Software Supply Chain Security, and JFrog has been recognized as a Leader, placing highest for Ability to Execute among all the vendors included. For an inaugural report in a category this important, that placement…

How JFrog and NanoClaw are Bringing Software Supply Chain Security to the Age of Autonomous AI

June 24, 2026 Gal Marder, JFrog Chief Strategy Officer | 5 min read

There's a category of security risk that most organizations aren't ready for. It doesn't live in your code repository, your CI pipeline, or your developer laptops. It lives in your runtime, in the autonomous AI agents already running in your environment, extending their own capabilities, and making decisions that no human explicitly approved. This is…

AI Overview

The JFrog Platform

Welcome to the JFrog Blog

Latest:

JFrog Artifactory Now Integrates Natively with Artifact Registry in Google Cloud

All Blogs

swampUP 2026 Preview: The Trust Layer for the Agentic Software Supply Chain

Agentic Development Security is a Discipline that Starts Before the First Line of Code

How to Control AI Assets Before They Become Shadow AI

Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

Secure AI Workflows: The Identity and Access Management (IAM) Checklist

Beyond Tokens SF: Best Ideas of the Evening

Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

JFrog Named a Leader in the Inaugural Gartner^® Magic Quadrant™ for Software Supply Chain Security

How JFrog and NanoClaw are Bringing Software Supply Chain Security to the Age of Autonomous AI

Popular Tags

Experience
JFrog Today

Discover how the JFrog Platform unites DevOps, DevSecOps and MLOps for secure, rapid software delivery.

Welcome to the JFrog Blog

Latest:

JFrog Artifactory Now Integrates Natively with Artifact Registry in Google Cloud

All Blogs

Popular Tags

Experience JFrog Today

Discover how the JFrog Platform unites DevOps, DevSecOps and MLOps for secure, rapid software delivery.

Experience
JFrog Today