DORA Article 16 creates a simplified ICT risk management framework for smaller financial entities. Firms that qualify carry materially fewer obligations than the ones they are usually quoted for.
Book a scoping callArticle 16 of DORA replaces the detailed ICT risk management requirements of Articles 5 to 15 with a narrower, simplified framework for six categories of smaller financial entity. DORA itself still applies: a documented ICT risk management framework, a register of ICT third-party arrangements, incident classification and reporting, and business continuity arrangements all remain required. What falls away is the heavier machinery around them — internal audit of the framework, mandatory cyber-attack scenario testing, legacy system risk analysis, and a dedicated third-party monitoring role.
Whether a given firm falls inside Article 16 turns on figures only that firm holds and on which permissions it actually exercises, so it cannot be read off any public register. Establishing that is what the scoping call is for.
Source: Regulation (EU) 2022/2554 on EUR-Lex. Supervisory material is published by ESMA and EIOPA.
Article 16 is not a discount on the full regime. It is a different, narrower set of obligations written into the regulation itself, and confirmed in supervisory guidance.
No requirement for regular internal audit of the ICT risk management framework.
No mandatory inclusion of cyber-attack scenarios in business continuity and recovery testing.
No requirement for regular risk analysis on legacy ICT systems.
No requirement to staff a dedicated role monitoring ICT third-party arrangements.
The full picture of what the simplified framework requires, and what it drops, is set out article by article in our free DORA framework mapping — every article of Commission Delegated Regulation (EU) 2024/1774 against ISO 27001, ISO 22301 and PCI DSS, with both regimes side by side.
Six categories of financial entity fall under the simplified framework, as set out in Article 16(1) of DORA. If your firm is one of them, the obligations above do not apply to you.
The tests that decide Article 16 eligibility are not published in any register. They sit in figures only your firm holds, and in which permissions you actually exercise rather than merely hold on your licence.
Assets under management, assets held and administered, client money held, daily trading flow, balance sheet total and annual revenue. Several of the tests are not a question of being small — they require the figure to be zero. None of this appears on a public register, so no list can tell you the answer.
Belonging to a group does not remove Article 16 on its own. It changes how the tests are calculated, because several of them must be assessed on a combined basis across the group. A subsidiary can still qualify. It simply takes a closer look to establish.
Everything available today is priced for the full Article 5 to 15 regime, or leaves you to interpret the regulation yourself.
| Option | Model | Typical cost |
|---|---|---|
| Large advisory firms | Project engagement scoped to the full regime, delivered over several months | €200,000 upwards |
| Compliance software | Annual licence. The tooling is provided, the interpretation and operation stay with you | €500 – €8,000 per year |
| Boutique DORA retainers | Monthly retainer, priced at general advisory level regardless of your firm's size | from around €2,500 per month |
None of them price for Article 16. The quote you receive is built for the full regime, and the work of arguing your way down to a proportionate scope is left to you.
Establishing whether you fall under Article 16 takes about half an hour, because the questions are specific and you already hold the answers.
Which DORA entity category your firm sits in, and which of the Article 16 routes could apply to you.
We work through the thresholds against your actual figures and the permissions you exercise.
If you qualify, exactly which obligations drop away, and what a proportionate framework looks like instead.
If you do not qualify, you will know that too, and why. That is a useful outcome on its own.
This page is reviewed against the regulation and the published technical standards. Last reviewed 16 September 2026.
Half an hour, against your own figures, with a straight answer at the end of it.
Book a scoping call