DORA for Insurance & Reinsurance Undertakings
Insurance and reinsurance undertakings, and certain insurance intermediaries, are within DORA's scope under Article 2. They must implement the ICT risk-management framework, classify and report major ICT incidents, test operational resilience, and manage ICT third-party risk, supervised by EIOPA and national authorities. DORA has applied since 17 January 2025.
Who exactly is covered
DORA covers insurance and reinsurance undertakings under Solvency II, and insurance, reinsurance and ancillary insurance intermediaries, with an exemption for intermediaries that are microenterprises or small/medium enterprises meeting the regulation's criteria.
What bites hardest
- Consolidating ICT and outsourcing governance under one framework.
- Building the register of information across a typically long tail of ICT vendors.
- Harmonised incident reporting, replacing sector-specific practices.
Proportionality for intermediaries
Smaller intermediaries benefit from exemptions and a simplified ICT risk-management framework. Larger insurers should expect full application. Use the readiness score to gauge your gaps. EIOPA has named DORA implementation a core 2026 supervisory priority for the sector, see our guide to EIOPA's 2026 supervisory priorities for insurers for what examiners are now checking beyond a filed framework.
What "microenterprise" actually means here
The Article 2(3) exemption for insurance, reinsurance, and ancillary insurance intermediaries turns on a specific, checkable size test, not a subjective sense of being "small." A microenterprise for this purpose is an undertaking with fewer than 10 employees and annual turnover or an annual balance sheet total below EUR 2 million; the exemption also extends to small and medium-sized intermediaries that meet the equivalent SME thresholds. The recitals explain the rationale directly: the insurance intermediation market is structured around a large number of very small firms, and applying the full ICT risk-management framework to all of them would be disproportionate given their size and the services they provide.
This creates a trap for mixed-activity intermediaries: a firm can look like a microenterprise on its insurance book alone while its combined turnover across insurance and non-insurance activities pushes it over the threshold, since the size test looks at the whole undertaking, not just the regulated activity. Groups that operate an intermediary alongside other business lines should run the employee-count and turnover test at the legal-entity level before assuming the exemption applies, and document that assessment as evidence for their competent authority.
Is a broader insurance exemption coming?
Unlike investment firms, insurance and reinsurance undertakings have no Article 16 "small and non-interconnected" route built into DORA itself, their only relief is the Article 2(3) microenterprise exemption for intermediaries described above. EIOPA has flagged this gap directly: in a November 2024 opinion, it asked the European Commission to consider excluding small insurance undertakings and intermediaries from DORA's scope, or scaling their obligations further, arguing that proportionality for very small insurers is better addressed through the ongoing Solvency II review than through DORA's narrower mechanisms. As of October 2026, the Commission has not acted on that opinion: the Solvency II review continues on its own track, and no DORA amendment carving out additional insurance-sector relief has been proposed or adopted. Small insurers and their advisers should not assume a broader exemption is coming; track EIOPA's own publications and the Solvency II review rather than treating the 2024 opinion as settled policy.
Frequently asked questions
Will small insurers get their own DORA exemption, like investment firms do?
Not yet. EIOPA asked the European Commission in a November 2024 opinion to consider excluding small insurers from DORA pending the Solvency II review, but as of October 2026 no such exemption has been proposed or adopted.
Are insurance intermediaries in scope of DORA?
Many are, but microenterprises and qualifying small/medium intermediaries are exempt under Article 2(3).
Which authority supervises DORA for insurers?
National competent authorities, with EIOPA as the relevant European Supervisory Authority for the insurance sector.
Does DORA replace Solvency II ICT expectations?
DORA sets the directly applicable ICT resilience rules; it operates alongside Solvency II governance and risk-management requirements.
What counts as a microenterprise for the Article 2(3) exemption?
Fewer than 10 employees and annual turnover or balance sheet total below EUR 2 million, assessed at the level of the whole undertaking, including non-insurance activities.