DORA Readiness Assessment

Irish credit unions · DORA applies from 2028-01-17

DORA trainingSign inCreate account

DORA: an introduction for credit unions

What it is, what it means for you, and how this assessment helps. About 20 minutes to read; the live session takes 85 minutes.

This is an educational summary, not legal advice. Statements marked 'confirm' depend on sources that may change; check them with your adviser or the Central Bank before relying on them.

1. Why DORA exists

4 minutes in the live session

Credit unions, like every financial firm, now depend on technology to hold savings, make payments and serve members. A cyber-attack, a software fault or a supplier failure can stop all of that at once. DORA, the Digital Operational Resilience Act, is a single set of EU rules for how financial firms manage technology risk and keep running when things go wrong.

Key points

  • DORA is Regulation (EU) 2022/2554. As a regulation it applies directly, not through national law alone.
  • It is about operational resilience: being able to withstand, respond to and recover from technology disruption.
  • It replaces a patchwork of national and sector rules with one framework across the EU financial sector.
  • It covers banks, insurers, investment firms, payment firms and, in Ireland, credit unions from 2028.
In practice. The firm that hosts your core banking system has an outage for two days over a payroll weekend. Members cannot see balances or make payments. Who do you call, what do you tell members, and could you have prepared? DORA is about being able to answer those questions in advance.

What it means for you

Board directors

Resilience is now a governance matter, not just an IT matter. The board is expected to take ownership.

Manager and staff

Many of the changes are practical habits: knowing who to call, keeping records, testing backups.

ICT and risk leads

Expect more documentation, testing, provider evidence and reporting than the current good practice.

Questions worth asking

  • Which of our services would hurt members most if they stopped for a day?
  • How do we know our providers could get us back up?
About this guide: what is verified and what is assumed

Checked against sources

  • Regulation (EU) 2022/2554 (DORA) is an EU regulation, adopted on 14 December 2022.
  • In Ireland, S.I. No. 20 of 2025 says DORA does not apply to credit unions until 17 January 2028 (regulation 3).
  • The Central Bank of Ireland is Ireland's competent authority for DORA; sanctions can be applied to members of the management body (S.I. 20/2025, regulations 4 and 6).
  • The Central Bank encourages firms outside DORA to use it as a benchmark, alongside its guidance on operational resilience, outsourcing and IT and cybersecurity risk (per Central Bank FAQ; its 2025 operational resilience guidance describes itself as complementary to DORA). Confirm the wording on the Central Bank website.
  • S.I. No. 20 of 2025 is titled European Union (Digital Operational Resilience) (No. 2) Regulations 2025. Its date of making is shown as February 2025; the exact day was not checked.

Assumptions to confirm

  • Credit unions will follow the simplified ICT risk management framework (Article 16). Reasoning: Article 16 covers institutions exempt under the Capital Requirements Directive, and Irish credit unions are on that exemption list (Directive 2013/36/EU, Article 2(5)). Nothing seen from the Central Bank confirms it, so it stays an inference. Check with counsel or the Central Bank.
  • Reporting time limits and templates come from technical standards and Central Bank instructions. Always check the current versions.

Version 0.1-draft. Draft wording awaiting expert review.