What is DORA and who does it apply to?

DORA (EU Regulation 2022/2554) is a binding EU law that took effect in January 2025. It applies to financial institutions operating in or serving the European Union—including banks, insurers, investment firms, and payment providers—as well as the ICT third-party providers supplying them. Its five pillars cover ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing.

Does DORA apply to software vendors outside the EU?

Yes. If your software or services are used by EU-regulated financial institutions, you fall within DORA's third-party ICT provider scope under Articles 28-44, regardless of where your company is headquartered. Any vendor in the software supply chain of an EU financial institution should review their DORA obligations, particularly around contractual requirements, audit rights, and supply chain transparency.

What are the penalties for DORA non-compliance?

Financial institutions found non-compliant face fines of up to 2% of total annual worldwide turnover. Critical ICT third-party providers can face penalties up to €5 million. Beyond financial penalties, regulators can require firms to suspend or terminate contracts with non-compliant ICT providers, making DORA exposure a severe commercial risk, not just a compliance risk. Note: exact penalty structures can vary by Member State enforcement; always consult legal counsel.

Why do AI coding agents create a specific DORA compliance problem?

DORA was designed around human-gated development processes where every change traces back to a named, accountable person. AI coding agents break that accountability chain by committing, building, and promoting artifacts autonomously. They pull dependencies without policy review, generate code with vulnerability classes legacy scanners miss, and produce no audit trail by default, leaving organizations unable to satisfy DORA's evidence requirements on demand.

What is DevGovOps and how does it address DORA?

DevGovOps is a Software Supply Chain Engineering practice that embeds continuous governance and compliance into the software delivery lifecycle. Rather than assembling compliance evidence after the fact, DevGovOps generates cryptographic attestations, enforces policy-as-code gates, and maintains a unified system of record automatically at every pipeline stage. For DORA specifically, it ensures that the evidence regulators require exists at the moment each decision is made, not weeks later.

How long does it take to produce DORA audit proof with and without DevGovOps?

According to the JFrog 2026 Software Supply Chain Security State of the Union, 48% of organizations need a week or more to produce compliance audit proof when asked, and only 6% can do it in under a day. With a DevGovOps approach, evidence is generated automatically at every pipeline run and is retrievable on demand, replacing multi-week manual assembly exercises with proof that already exists.

automatisation Archives

La gouvernance à la vitesse de l’IA : comment le DevGovOps comble l’écart de conformité DORA

August 17, 2026

Qu’est-ce que le DevGovOps ? Le DevGovOps est une pratique d’ingénierie de la chaîne d’approvisionnement logicielle qui intègre la gouvernance et la conformité continues dans le cycle de vie de livraison de logiciels DevOps. Plutôt que de traiter la conformité comme un obstacle manuel et rétrospectif, le DevGovOps garantit que l’application des politiques, l’auditabilité continue et …

AI Overview

La plateforme JFrog

La gouvernance à la vitesse de l’IA : comment le DevGovOps comble l’écart de conformité DORA

Popular Tags