DORA Article 16: Who Qualifies for the Simplified Framework

Q: What is DORA Article 16's simplified ICT risk management framework?

DORA Article 16's simplified ICT risk management framework is a lighter-touch version of DORA's ICT risk management chapter, available only to the entity types named in Article 16(1), replacing Articles 5-15 with a reduced but still documented set of core obligations.

Q: Does Article 16 exempt a firm from DORA incident reporting or third-party rules?

No. DORA Article 16 only replaces Articles 5-15 on ICT risk management. The incident reporting, resilience testing, and third-party risk chapters still apply in full to a simplified-framework entity, subject only to the general proportionality principle in Article 4 that applies to every in-scope entity.

Q: Is Article 16 a general exemption for small businesses?

No. DORA Article 16 is not a general small-business exemption. It applies only to the specific entity categories named in Article 16(1). A small company that does not fall into one of those categories, including many small fintechs, remains subject to the full Articles 5-15 framework regardless of headcount or revenue.

Q: What must a simplified-framework entity still document?

A simplified-framework entity must still document an ICT risk management framework, continuous monitoring of ICT systems, business continuity and disaster recovery arrangements, identification of ICT third-party dependencies, and a mechanism for incorporating lessons from incidents and tests. The framework must be reviewed periodically and reported to the competent authority on request.

Q: Can an entity lose its Article 16 eligibility?

Yes. Article 16 eligibility follows the entity's status under its own sectoral directive, such as the small and non-interconnected investment firm test under the Investment Firms Regulation. If that status changes, for example the firm grows past the relevant thresholds, Article 16 eligibility changes with it, and the entity moves to the full DORA ICT risk management framework.

DORA Article 16 lets a named list of smaller or exempted financial entities, small and non-interconnected investment firms, certain exempted payment and e-money institutions, specific institutions exempted under Directive 2013/36/EU, and small occupational pension institutions, replace the full Articles 5-15 framework with a lighter, still-documented one. It is not a general small business exemption, and it does not touch incident reporting, testing, or third-party rules.

What Article 16 actually exempts, and what it does not

Article 16(1) is narrow by design: "Articles 5 to 15 of this Regulation shall not apply to" the entities it names. That single sentence is the entire scope of the exemption. It removes the detailed governance and control requirements in DORA's ICT risk management chapter, things like a dedicated ICT risk control function, granular policy documentation across eight domains, and the full audit cadence the baseline framework demands.

It does not touch anything else in the regulation. Chapter III (incident reporting), Chapter IV (resilience testing), Chapter V (third-party risk), and Chapter VI (information sharing) all still apply in full to a simplified-framework entity, subject only to the general proportionality principle in Article 4 that applies to every in-scope firm regardless of size. An entity that qualifies for Article 16 still classifies and reports major incidents, still maintains a register of ICT third-party arrangements, and still runs a proportionate testing programme. The exemption is scoped to one chapter, not the regulation as a whole.

The four entity categories named in Article 16(1)

Only entities that fall into one of these categories can use the simplified framework:

Small and non-interconnected investment firms, as defined under the Investment Firms Regulation thresholds (small balance sheet, limited interconnectedness with the wider financial system, and none of the factors that would otherwise classify the firm as Class 2 or systemic).
Payment institutions exempted under Directive (EU) 2015/2366 (PSD2), where the Member State has granted the small-institution exemption from full authorisation.
Electronic money institutions exempted under Directive 2009/110/EC, on the same small-institution basis.
Institutions exempted under Directive 2013/36/EU (the Capital Requirements Directive), specifically those for which the Member State has not applied the option in Article 2(4) of DORA to bring them back into full scope.
Small institutions for occupational retirement provision (IORPs), as defined in the IORP II Directive.

If an entity does not fall cleanly into one of these categories, it is in the full Articles 5-15 regime regardless of headcount or revenue. A mid-sized investment firm that fails the "small and non-interconnected" test, or a payment institution that holds a full PSD2 authorisation rather than the small-institution exemption, gets no benefit from Article 16. There is no case-by-case waiver process; eligibility turns on the entity's status under its own sectoral directive, not on a separate DORA application.

What the simplified framework still requires

Article 16(2) lists the core obligations that survive even where Articles 5-15 do not apply. A qualifying entity must still maintain:

A sound, documented ICT risk management framework, covering the ICT systems, protocols, and tools the entity actually depends on.
Continuous monitoring of the security and functioning of ICT systems, with mechanisms to minimise their impact on ICT risk.
Business continuity and disaster recovery arrangements adequate to the entity's size, risk profile, and the criticality of the services it provides.
Identification of ICT third-party dependencies, so the entity knows which of its ICT systems rely on which providers.
A mechanism for incorporating lessons learned from ICT-related incidents and from testing, feeding back into the framework rather than sitting in a closed report.

The framework must be reviewed periodically and after major ICT-related incidents, following supervisory instructions, and the entity must be able to produce a report on that review for the competent authority on request. In practice this is a scoped compliance programme, not a checklist waiver: an entity still needs policies, an assigned owner, and evidence of ongoing review, just not the full eight-domain structure Article 5 requires of larger institutions.

The technical standards behind Article 16

Article 16(3) requires the European Supervisory Authorities, in consultation with ENISA, to develop regulatory technical standards further specifying the content of the simplified framework. That mandate produced Commission Delegated Regulation (EU) 2024/1774, which sets out the detailed elements of both the full and the simplified ICT risk management frameworks. The RTS is explicit that the simplified framework's proportionate character must not be eroded by the technical detail it adds: the obligations in Article 16(2) are specified, not expanded into a parallel version of the full framework.

How to check whether your entity qualifies

Confirm your sectoral status first. Eligibility for Article 16 is a consequence of status under the Investment Firms Regulation, PSD2, Directive 2009/110/EC, Directive 2013/36/EU, or IORP II, not a DORA-level test on its own. If that status changes (the firm grows past the small and non-interconnected thresholds, for example), Article 16 eligibility changes with it.
Check whether your Member State disapplied the Article 2(4) option for CRD-exempted institutions. Some Member States have chosen to bring these institutions back into full DORA scope, which overrides the Article 16 exemption for that category.
Document the review, even while simplified. Supervisors can request the review report at any time; an entity that assumed simplified status meant no paperwork will not have one ready.
Re-test eligibility on a schedule, not once. A firm that qualified as small and non-interconnected at authorisation can lose that status as it grows, and nothing in DORA grants a grace period for re-scoping into the full framework.
Map what Article 16 does not cover. Run the DORA Readiness Score against the full set of DORA requirements rather than assuming simplified ICT risk management means simplified DORA compliance generally.

Common mistakes entities make with Article 16

The most frequent error is treating Article 16 as a general small-business carve-out. It is not: a small fintech that is not a payment institution, e-money institution, or small IORP, and is not a "small and non-interconnected" investment firm under the statutory test, gets no benefit from this article no matter how few people it employs. The second most common mistake is assuming the exemption reaches beyond ICT risk management, entities have been caught out assuming simplified status also meant a lighter incident-reporting timeline or an automatic exemption from third-party contract requirements, neither of which Article 16 provides. The third is documentation drift: because the simplified framework has fewer mandated components, firms sometimes stop maintaining evidence altogether, leaving nothing to show when a competent authority asks for the review report Article 16(2) requires.

Frequently asked questions

What is DORA Article 16's simplified ICT risk management framework?

It is a lighter-touch version of DORA's ICT risk management chapter, available only to the entity types named in Article 16(1), replacing Articles 5-15 with a reduced but still documented set of core obligations.

Which entities can use the DORA simplified framework?

Only small and non-interconnected investment firms, certain exempted payment institutions and electronic money institutions, specific Directive 2013/36/EU exempted institutions, and small institutions for occupational retirement provision. No other entity type qualifies, regardless of size.

Does Article 16 exempt a firm from DORA incident reporting or third-party rules?

No. Article 16 only replaces Articles 5-15. The incident reporting, resilience testing, and third-party risk chapters still apply in full, subject only to the general proportionality principle in Article 4 that applies to every in-scope entity.

Is Article 16 a general exemption for small businesses?

No. It applies only to the specific entity categories named in Article 16(1). A small company that does not fall into one of those categories, including many small fintechs, remains subject to the full Articles 5-15 framework regardless of headcount or revenue.

What must a simplified-framework entity still document?

A documented ICT risk management framework, continuous monitoring of ICT systems, business continuity and disaster recovery arrangements, identification of ICT third-party dependencies, and a mechanism for incorporating lessons from incidents and tests. The framework must be reviewed periodically and reported to the competent authority on request.

Can an entity lose its Article 16 eligibility?

Yes. Eligibility follows the entity's status under its own sectoral directive, such as the small and non-interconnected investment firm test. If that status changes, for example the firm grows past the relevant thresholds, Article 16 eligibility changes with it, and the entity moves to the full framework.

Sources

Regulation (EU) 2022/2554 (DORA), Article 16, EUR-Lex.
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024, EUR-Lex, regulatory technical standards on the ICT risk management framework and the simplified ICT risk management framework.
European Banking Authority, Joint final RTS on ICT risk management framework and simplified ICT risk management framework.

Last updated: 5 October 2026.