DORA for Insurers: EIOPA's 2026 Supervisory Priorities

EIOPA's 2026 work programme names DORA implementation as a core supervisory priority for insurers and reinsurers, with three areas singled out for closer scrutiny: the completeness and accuracy of the register of information, the adequacy of ICT incident classification methodologies, and board-level governance of ICT third-party oversight. Insurers already past their January 2025 compliance deadline should treat 2026 as the year supervisors start testing, not just checking, these controls.

Why EIOPA's 2026 priorities matter for insurers now

DORA has applied to insurance and reinsurance undertakings since 17 January 2025, alongside insurance intermediaries above the microenterprise threshold. For the first year, national competent authorities and EIOPA largely focused on confirming that entities had a framework in place at all: policies drafted, a register of information filed, an incident classification procedure documented. 2026 is different. EIOPA's Annual Work Programme signals a shift from existence checks to quality checks, meaning supervisors will ask not just "does the register exist" but "is it complete, accurate, and actually usable for oversight."

That shift matters because DORA's ICT risk-management framework was built around ongoing, evidenced compliance rather than a one-time filing exercise. An insurer that treated January 2025 as the finish line, rather than the starting point of a maintained control environment, is the entity most exposed to a critical finding in a 2026 supervisory review.

Priority one: the register of information has to hold up under scrutiny

The register of information required under Article 28 is the single artifact EIOPA has flagged most consistently: a structured inventory of every ICT third-party arrangement, from core policy administration systems down to niche SaaS tools, submitted in the standardised XML or CSV templates set by the technical standards.

Completeness and accuracy sound like a low bar, but they are where most insurers stumble in practice. Common gaps include:

• Missing ancillary arrangements. Contracts signed by a business unit outside procurement's usual workflow, marketing analytics tools or a claims-adjustment plugin, often never make it into the register.
• Stale sub-outsourcing chains. A provider's own subcontractors change without the insurer's register being updated to match.
• Inconsistent criticality tagging. The same type of function is marked "critical or important" at one entity and "standard" at another, with no documented rationale for the difference.

Our practical guide to building a first register of information walks through the submission template and the most common drafting mistakes in more detail; the third-party risk pillar page covers the underlying Article 28-44 obligations the register supports.

Priority two: incident classification methodology, not just the report itself

DORA's incident-reporting pillar sets classification criteria under Article 18 and reporting duties under Article 19: entities must classify ICT-related incidents against thresholds covering client and financial impact, reputational impact, duration, geographic spread, data losses, and criticality of affected services, then report major incidents on set timelines.

EIOPA's focus for 2026 is on the methodology behind that classification, not just whether reports arrive on time. In practice, that means being able to show:

• A documented decision process mapping an incident's characteristics to the classification thresholds, rather than a judgment call made informally by whoever is on call.
• Consistency in how "major" gets applied across similar incidents, so classification does not quietly drift depending on who triages the ticket.
• A record of near-misses and incidents that fell below the major-incident threshold, since a pattern of borderline cases can itself be a supervisory red flag if the threshold always gets applied downward.

An insurer that has never had to report a major incident should not read that as evidence its classification methodology is sound; it may just mean the methodology has never been stress-tested against a real event.

Priority three: board-level ownership of ICT third-party oversight

DORA puts personal accountability for ICT risk on the management body, a duty we cover in more depth in our guide to Article 5's management body duties. For insurers, EIOPA's 2026 focus extends that principle specifically to third-party oversight: the board, not a delegated IT or procurement function alone, needs to be able to show it understands and actively manages concentration risk, exit strategy readiness, and the criticality tiering behind the register of information.

Boards that treat ICT third-party risk as a technical topic delegated entirely downward, with oversight limited to an annual summary slide, are the ones most likely to draw a finding here. The expectation is active governance: board minutes that show ICT third-party risk was genuinely discussed, questioned, and challenged, not just noted as received.

How this sits alongside Solvency II governance

DORA does not replace Solvency II's Pillar 2 governance requirements; it runs alongside them, adding a technology-specific layer to the general system of governance insurers already maintain. EIOPA withdrew its own pre-DORA ICT security and cloud-outsourcing guidelines specifically to avoid duplicating what DORA now covers directly, which means insurers can no longer point to older EIOPA guidance as a fallback interpretation where DORA's text is more demanding. Where the two frameworks overlap, on risk governance structure, DORA's more detailed and directly applicable rules on ICT risk management, incident classification, and third-party oversight now set the operative standard.

A two-quarter action list

Insurers wanting to get ahead of a 2026 supervisory review should prioritise, roughly in this order:

1. Audit the register of information against actual contracts, not against what procurement believes is on file. Reconcile the register to the accounts-payable ledger for ICT vendors to catch arrangements that never made it in.
2. Document the incident classification methodology as a standalone artifact, with worked examples showing how a hypothetical incident would be scored against each threshold.
3. Put ICT third-party risk on the board agenda as a standing item, with minutes that record substantive discussion, not just a status update.
4. Re-run the criticality assessment behind the register, since functions that were "standard" at go-live can become critical as the business changes, and the register needs to keep pace.
5. Use the DORA Readiness Score to benchmark where gaps remain across all five pillars before a supervisor finds them first.

Where intermediaries and smaller insurers stand

Proportionality still applies. Intermediaries and undertakings meeting the Article 2(3) microenterprise or SME thresholds remain outside the full framework, and EIOPA's 2026 priorities do not change that carve-out. What they do change is the standard applied to everyone still inside scope: "proportionate" is increasingly read as "scaled to size," not "optional if resources are tight." A mid-sized insurer eligible for the simplified framework should still expect its register, classification methodology, and board oversight to be assessed against what is reasonable for an entity of its size, not waved through entirely. Our who-must-comply guide for insurers covers the scope test in full, including the mixed-activity trap that catches some intermediaries by surprise.

Common gaps seen in practice

• Treating the register of information as a one-time submission. It needs the same update discipline as any live compliance record, since a stale register is functionally the same problem as a missing one from a supervisor's perspective.
• No documented link between classification methodology and actual incidents. A procedure that exists on paper but has never been applied to a real or simulated incident is hard to defend under review.
• Board minutes that record ICT third-party risk as informational only. Passive receipt of a report is not the same as governance, and EIOPA's 2026 focus is squarely on the latter.
• Assuming Solvency II governance experience covers the gap. DORA's ICT-specific requirements are more granular than general Pillar 2 expectations and need their own evidenced compliance trail.

Insurers working through a broader DORA checklist or scoping which pillar needs the most attention can pair that work with the Readiness Score to prioritise where a 2026 supervisory review is most likely to find gaps.

Sources

• Regulation (EU) 2022/2554 (DORA), Articles 5, 18-19, 28, EUR-Lex.
• EIOPA, Annual Work Programme 2026.
• EIOPA, Digital Operational Resilience Act (DORA).

Last updated: 14 September 2026.