DORA for Insurance & Reinsurance Undertakings
Insurance and reinsurance undertakings, and certain insurance intermediaries, are within DORA's scope under Article 2. They must implement the ICT risk-management framework, classify and report major ICT incidents, test operational resilience, and manage ICT third-party risk, supervised by EIOPA and national authorities. DORA has applied since 17 January 2025.
Who exactly is covered
DORA covers insurance and reinsurance undertakings under Solvency II, and insurance, reinsurance and ancillary insurance intermediaries, with an exemption for intermediaries that are microenterprises or small/medium enterprises meeting the regulation's criteria.
What bites hardest
- Consolidating ICT and outsourcing governance under one framework.
- Building the register of information across a typically long tail of ICT vendors.
- Harmonised incident reporting, replacing sector-specific practices.
Proportionality for intermediaries
Smaller intermediaries benefit from exemptions and a simplified ICT risk-management framework. Larger insurers should expect full application. Use the readiness score to gauge your gaps.
What "microenterprise" actually means here
The Article 2(3) exemption for insurance, reinsurance, and ancillary insurance intermediaries turns on a specific, checkable size test, not a subjective sense of being "small." A microenterprise for this purpose is an undertaking with fewer than 10 employees and annual turnover or an annual balance sheet total below EUR 2 million; the exemption also extends to small and medium-sized intermediaries that meet the equivalent SME thresholds. The recitals explain the rationale directly: the insurance intermediation market is structured around a large number of very small firms, and applying the full ICT risk-management framework to all of them would be disproportionate given their size and the services they provide.
This creates a trap for mixed-activity intermediaries: a firm can look like a microenterprise on its insurance book alone while its combined turnover across insurance and non-insurance activities pushes it over the threshold, since the size test looks at the whole undertaking, not just the regulated activity. Groups that operate an intermediary alongside other business lines should run the employee-count and turnover test at the legal-entity level before assuming the exemption applies, and document that assessment as evidence for their competent authority.
Frequently asked questions
Are insurance intermediaries in scope of DORA?
Many are, but microenterprises and qualifying small/medium intermediaries are exempt under Article 2(3).
Which authority supervises DORA for insurers?
National competent authorities, with EIOPA as the relevant European Supervisory Authority for the insurance sector.
Does DORA replace Solvency II ICT expectations?
DORA sets the directly applicable ICT resilience rules; it operates alongside Solvency II governance and risk-management requirements.
What counts as a microenterprise for the Article 2(3) exemption?
Fewer than 10 employees and annual turnover or balance sheet total below EUR 2 million, assessed at the level of the whole undertaking, including non-insurance activities.