What does DORA Article 5 actually require from the board?

Article 5 sets out eight specific obligations for the management body. The key ones regulators are focusing on in 2026 supervisory reviews:

What documentation must the board produce to satisfy supervisors?

Board-approved ICT risk management framework

What are the most common board-level DORA gaps regulators find?

Based on EBA and national competent authority supervisory findings published in 2025, the top five board-level gaps are: (1) ICT risk framework not separately approved by the board — embedded in general risk policy; (2) No quantified risk appetite; (3) Board minutes show no substantive ICT discussion; (4) No board training records for DORA; (5) Third-party ICT risk policy approved at CIO level, not board level.

Can the board delegate DORA Art. 5 responsibilities to a risk committee?

Partial delegation is allowed — the board can task a risk or audit committee with monitoring. However, the management body retains ultimate accountability. Approval of the ICT risk framework and the risk appetite statement must remain at full board level. Supervisors have found instances where entities delegated too far and this was treated as a material gap.

How often must the board review the ICT risk framework under DORA?

At least annually, and after any major ICT incident or significant change to the business model or operating environment. The EBA guidelines recommend a structured annual review with a documented gap assessment against the current RTS on ICT risk management tools.

What ICT risk training is the board required to complete?

DORA Art. 5(4) requires board members to "keep up-to-date sufficient knowledge and skills to understand and assess ICT risk." The regulation does not specify hours or format. Supervisors in 2025 examinations have accepted annual sessions of 2-4 hours covering the entity's risk profile, recent incidents, and regulatory updates — provided these are documented.

Does DORA apply to the board of a subsidiary or only the group parent?

DORA applies entity-by-entity. Each in-scope legal entity's management body bears the obligations under Art. 5, even if that entity is part of a larger group. Group-level frameworks can be used, but each subsidiary's board must formally adopt and approve the framework as applicable to it.

What is the sanction for board non-compliance with DORA Art. 5?

DORA Art. 50 allows competent authorities to impose administrative pecuniary sanctions of up to 1% of average daily global turnover for ongoing infringements, and up to 2% for critical third-party ICT providers. For management body members personally, Art. 53 enables sanctions including temporary bans from senior functions.

Is DORA board governance the same for all financial entities, or is there proportionality?

DORA Art. 4 introduces a proportionality principle for microenterprises (fewer than 10 staff and under €2M turnover), which may apply a simplified ICT risk management framework. However, the management body obligations under Art. 5 apply to all in-scope entities regardless of size — only the complexity of the framework is scaled.

RegTech

Obligaciones de Gobernanza del Consejo bajo DORA 2026: Qué debe hacer realmente el Órgano de Dirección

Gerard Maymó

12 de junio de 2026

11 min read

Board meeting DORA ICT governance compliance

#DORA board governance#DORA Art 5 management body#DORA board responsibilities#ICT risk governance board#DORA compliance 2026#DORA supervisory review#financial entity board DORA#DORA management body obligations

COMPARTIR

Comparte el conocimiento con tu red

Obligaciones de Gobernanza del Consejo bajo DORA 2026: Qué debe hacer realmente el Órgano de Dirección

COMPARTIR

Artículos relacionados

DORA Gestión de Riesgos TIC para Bancos 2026: Guía de Cumplimiento Capítulo II

Reglamento DORA de la UE y Contratos TIC con Terceros: Guía para Gestores de Activos y PropTech (2026)