The EU regulation stack: DORA, CRA and the cost of compliance

The European Union has spent the better part of a decade constructing what is arguably the most ambitious technology governance framework on the planet, and this year, three of its most consequential regulations are converging on businesses simultaneously. The Digital Operational Resilience Act. The Cyber Resilience Act. The AI Act. Individually, each one would represent a significant compliance undertaking. Together, they form a regulatory stack that is reshaping how companies design products, manage infrastructure, and budget for risk. The timing is not a coincidence. Brussels deliberately staggered the enforcement milestones so that each regulation’s reporting and compliance deadlines would land in sequence across 2025, 2026, and 2027. The intent was to give businesses time to prepare. The reality, for most organizations, is that preparation fell behind schedule and the deadlines arrived anyway. Only 50 percent of financial institutions are estimated to be fully compliant with DORA as of early 2026. The CRA’s first mandatory reporting deadline hits in September. The AI Act’s high-risk obligations become enforceable in August. For Chief Technology Officers and compliance teams across Europe, this is the summer of paperwork, and the penalties for falling short are not symbolic.

DORA: the financial sector’s stress test

The Digital Operational Resilience Act, which entered into full application on January 17, 2025, targets the financial services industry with a straightforward premise: if your business depends on digital systems, you must prove those systems can survive disruption. Banks, insurance companies, investment firms, payment processors, and their critical ICT providers are all in scope. The regulation requires comprehensive risk management frameworks, mandatory incident reporting, regular resilience testing, and detailed oversight of third-party technology providers. The compliance costs have been substantial. Research indicates that most institutions spent between two and five million euros on DORA implementation, with 47 percent of UK-based firms and 38 percent of EU-based firms reporting expenditures exceeding one million euros over the past two years. For large financial organizations, the figures reach into the tens of millions. More concerning for long-term budgets, 70 percent of institutions expect permanently higher run costs for technology controls as a result of DORA’s ongoing requirements. Enforcement is now intensifying. National regulators across the EU submitted their first Register of Information filings to the European Supervisory Authorities by the end of March 2026, creating the first comprehensive inventory of which technology providers the financial sector depends on and where concentration risks exist. Beyond the headline fines, which can reach up to two percent of global turnover for financial entities and up to five million euros for critical ICT providers, regulators can impose daily recurring penalties of up to one percent of average daily worldwide turnover to force immediate remediation. The message is clear: DORA is not a box-ticking exercise. It is a regime with teeth.

CRA: every connected device, every manufacturer

While DORA focuses on financial services, the Cyber Resilience Act casts a far wider net. The CRA applies to all “products with digital elements,” a category that includes hardware, embedded software, standalone software, IoT devices, industrial sensors, smart home products, wearables, gateways, and virtually anything that connects to a network. If your company manufactures, imports, or distributes connected products in the European market, the CRA applies to you.

The regulation entered into force on December 10, 2024, but compliance is phased. The first critical deadline arrives on September 11, 2026, when manufacturers must begin reporting actively exploited vulnerabilities and severe security incidents to the relevant national Computer Security Incident Response Team via the CRA’s Single Reporting Platform. The full suite of core requirements, including mandatory secure-by-design practices, threat modeling, access controls, encryption standards, and the ability to deliver over-the-air security updates, takes effect on December 11, 2027.