Simplified framework under Article 16
Transition from BAIT: into the simplified framework under DORA Article 16
For institutions under Section 1a(2a) of the German Banking Act (KWG) (here: KWG group), such as factoring and finance leasing firms, the BAIT (BaFin’s supervisory requirements for IT in banks) end on 31 December 2026, and from 1 January 2027 the simplified framework under Article 16 DORA applies. In our transition from BAIT we rebuild your BAIT documents for this framework, set roles, rehearse recovery and reporting and hand over the evidence. For the base scope described below €12,500 net plus VAT. We price a larger scope after the scoping call.
What changes on 1 January 2027?
From 1 January 2027 the KWG group applies the simplified framework under Article 16 DORA under Section 1a(2a) in conjunction with Section 65a(3) KWG, while incident reporting under Chapter III has applied since 17 January 2025. Until the end of the year the BAIT continue to apply in full, so the rebuild has to be prepared in parallel. Some BAIT requirements no longer have an explicit counterpart, and some things are new, such as the business impact analysis approved by the management body. MaRisk (BaFin’s Minimum Requirements for Risk Management) still requires an emergency concept for these institutions (AT 7.3). What exactly falls away and what remains is shown on our pages on BAIT and DORA and on DORA Article 16. The transition takes your existing BAIT documentation as its starting point and moves it into the new framework without giving up roles and documents that work.
What does the transition from BAIT include?
Seven building blocks that build on each other. References without further detail relate to Commission Delegated Regulation (EU) 2024/1774 (RTS), Title III.
What do we already have?
Inventory of BAIT documents
We assign each existing document to the rows of the BAIT-DORA mapping and decide with you whether to keep it unchanged, rebuild it or merge it. For requirements without an explicit counterpart we clarify which task remains.
To the BAIT-DORA mappingWhich documents does the RTS require?
Rebuilding policies and procedures
An information security policy under Article 29 that covers all measures of Articles 30-38, plus the procedures for risk assessment (Article 31), access control (Article 33), ICT operations with vulnerabilities, patches and logging (Article 34), changes (Article 38), the testing plan (Article 36) and the business continuity plan (Article 39).
Who does what?
Roles and independence
Duties of the management body under Article 28(2), appropriate segregation and independence of control and internal audit functions (Article 28(4)), ICT expertise in internal audit (Article 28(5)). We clarify with you who takes over the tasks of the former information security officer and prepare the decision of the management body.
What is critical?
Classifying critical or important functions
List of functions with reasons, supporting assets and providers (Article 30), business impact analysis for approval by the management body (Article 28(2)(d)) and recovery objectives per function (Article 39(2)(d)). We also record your figures on headcount, turnover and balance sheet total and flag borderline cases for legal clarification.
Classifying functionsDoes it work when it matters?
Recovery and reporting exercise
One backup and restoration exercise for a critical or important function (Article 40) and a reporting exercise as a tabletop up to the initial notification, within 4 hours of classification as major and no later than 24 hours after awareness. We do not plan on weekend relief, because it is open whether it applies to the KWG group. Deficiencies go to the management body with a report.
DORA reporting obligationWhere is the evidence?
Evidence handover
Evidence matrix along Article 16 DORA and RTS Articles 28-41 with owners and storage location, a template for the review report under Article 41 and, where Articles 28-30 apply, a subject-matter comparison of your ICT contracts with the mandatory terms under Article 30 DORA.
Evidence matrix for Article 16What comes back every year?
Annual calendar
Recurring duties with dates and owners: review the budget annually (Article 28(2)(e)), test the business continuity plans annually (Article 40), risk assessment, recertification of access rights, testing programme under Articles 24 and 25 DORA, review of the framework under Article 16(2) DORA. On our reading we plan for the testing programme as a precaution. The reasoning is on our page on DORA Article 16.
DORA Article 16 overviewWhat you have at the end
We hand over the results as drafts for your institution to put into force and as an organised evidence file.
01
Assignment of your BAIT documents
All documents with a decision (keep, rebuild, merge) and the row in the BAIT-DORA mapping.
02
Policy and procedures
Information security policy under RTS Article 29 and the procedures, rebuilt from your own texts where possible.
03
Role model with draft resolution
Who takes on which task, how control and internal audit are segregated and what the management body decides.
04
List of functions, BIA and recovery objectives
Critical or important functions with reasons, business impact analysis and recovery levels and timeframes per function.
05
Exercise records
Record of the recovery exercise and evaluation of the reporting exercise, each with deficiencies, actions and report to the management body.
06
Evidence matrix and annual calendar
Each requirement with evidence and storage location, template for the review report under RTS Article 41, calendar of recurring duties.
Example: schedule for a start in November 2026
This is how the transition can run if the scoping call takes place in mid-November and the management body has a date free in December. An example, not a commitment: meeting dates of the management body, public holidays and your provider’s availability move the plan.
| Period | Phase | Result | Status on 1 January 2027 |
|---|---|---|---|
| Mid to end of November 2026 | Inventory and classification | Assignment of BAIT documents, figures on the microenterprise criteria, drafts of the list of functions and business impact analysis | done |
| December 2026 | Roles, policy, list of functions and BIA | Role model, information security policy, list of functions and business impact analysis adopted by the management body, reporting process checked | targeted, depending on the meeting date of the management body |
| December 2026 to January 2027 | Procedures and business continuity plan | Procedures, recovery objectives, comparison of contracts with Article 30, business continuity plan approved by the management body by January 2027 | in progress, obligations already apply |
| First quarter of 2027 | Exercises and handover | Recovery and reporting exercise, evidence matrix, annual calendar | after the reference date, or already in 2026 if you can |
Example by Blackfort Technology, no commitment on dates or results.
What does the transition from BAIT cost, and where are the limits?
€12,500 net for the base scope described below. We price additional legal entities, documents, workshops or providers after the scoping call.
| Building block | Included |
|---|---|
| Legal entities | one |
| BAIT documents in the inventory | up to 40 documents |
| Workshops (up to 3 hours each, by video or on site) | up to 6, of which 2 with the management body |
| Policy and procedures | information security policy and up to 8 procedures as drafts |
| ICT service providers | up to 5 in the list of functions and the comparison with Article 30 |
| Recovery exercise | one, for a critical or important function. Planning, support and record by us, carried out by your IT or your provider |
| Reporting exercise | one, as a tabletop of up to 3 hours |
| Evidence handover | evidence matrix, review report template, annual calendar |
| Price | €12,500 net plus VAT for this base scope |
Offered to businesses only (B2B). We price additional legal entities, documents, workshops or providers after the scoping call and state the price in our proposal. An Article 16 gap analysis commissioned beforehand is credited, with details in the proposal.
How does the transition work?
Four phases. How long they take depends mainly on how quickly documents, meeting dates and decisions come together.
1
Inventory and classification
Assign BAIT documents to the mapping, record figures on the microenterprise criteria, draft the list of functions and the business impact analysis.
2
Roles, policy, list of functions and BIA
Role model and information security policy, decision of the management body on roles, list of functions and business impact analysis, check the reporting process.
3
Procedures and business continuity plan
Rebuild procedures, recovery objectives and business continuity plan for approval by the management body, compare contracts with Article 30.
4
Exercises and handover
Recovery and reporting exercise, evidence matrix, review report template, annual calendar.
From 1 January 2027 the obligations under Article 16 apply regardless of how far the project has got. A schedule does not postpone any obligation. It sets what comes first: what is needed from day one, meaning roles, policy and a working reporting process.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Transition from BAIT or gap analysis?
The Article 16 gap analysis is an analysis with an action plan: it shows where you stand and what to do in which order, and leaves open who implements it. The transition from BAIT is implementation with handover of results: at the end you have rebuilt documents, adopted roles, rehearsed procedures and an organised evidence file.
You can start with the gap analysis and commission the transition afterwards, in which case the Article 16 gap analysis is credited, with details in the proposal. You can also start directly with the transition, which includes the inventory. For firms that already apply Article 16 and have no BAIT documentation to rebuild, such as small investment firms, small IORPs or insurance holding companies, the gap analysis is usually the better fit.
If your institution is a microenterprise
Articles 28-30 DORA do not apply to microenterprises of the KWG group, so the register of information and the mandatory terms for ICT contracts under Article 30, among other things, fall away. For factoring and leasing firms, however, total assets are often above the threshold of EUR 2 million. We therefore record your figures at the start and do not assume the status. Our page on DORA applicability explains the criteria and borderline cases.
For the scope of the service this means: the comparison of contracts with Article 30 is dropped. The providers stay in the list of functions and the business continuity plan, because microenterprises also identify their key dependencies on ICT third-party service providers. On our reading, ICT third-party sourcing then remains under AT 9 MaRisk, because its exemption only covers services subject to Articles 28-30.
Who is responsible for the service
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology. We know the transition from an ISMS engagement with a factoring firm moving to Article 16 (since 07/2026). We do not name clients.
What does your institution contribute?
One contact person
For example the former information security officer or the head of IT, with about half a day to a day per week for coordination, documents and reviewing drafts.
The management body
Two meetings and the decisions on roles, policy, business impact analysis and business continuity plan. Responsibility for the framework stays with the management body.
IT and providers
Information on systems and contracts, carrying out the recovery exercise and taking part in the reporting exercise.
What is not part of the transition from BAIT?
To set expectations:
- No technical implementation. Your IT or your provider sets up strong authentication, logging or vulnerability scanning. We describe the requirement and review the evidence. Technical implementation with us is agreed separately.
- No contract negotiation and no legal contract review. The comparison with the mandatory terms under Article 30 DORA is a subject-matter check. Drafting and reviewing the clauses is for your legal counsel, and your institution conducts the negotiations. Setting up and submitting the register of information is not part of the service. When the KWG group first submits it is, as far as we know, still open.
- We do not take over roles. We take on the role of an external information security officer or of internal audit only under a separate engagement.
- No commitment that everything will be finished by 1 January 2027, and no commitment on how supervisors or auditors will assess the result. No certificate, no legal advice.
The assessments on this page are general information on DORA, RTS 2024/1774 and the KWG as they currently stand. Whether and how they apply to your institution has to be checked in the individual case.
Frequently asked questions
Can we complete the transition by 1 January 2027?+
That depends on when you start and on your meeting dates. With a start in November, classification, roles, policy, an adopted list of functions and BIA and a checked reporting process can be in place by year end if the management body can decide in December. The business continuity plan follows by January 2027, exercises and evidence handover in the first quarter of 2027. The obligations still apply from 1 January 2027, so what is needed from day one comes first. We do not commit to everything being finished by then.
Do we have to abolish our information security officer?+
No. The tasks remain, even though the simplified framework no longer names the role explicitly. In the “Roles and independence” building block we clarify with you who takes on which task. More on this on our page on DORA Article 16.
Is the gap analysis credited?+
Yes. An Article 16 gap analysis commissioned beforehand is credited against the transition from BAIT. The details are in the proposal.
What happens after the handover?+
You run the framework yourself, with the annual calendar as a guide. If you wish, we support the first review of the framework or the next exercise. This is agreed separately.
When can we start?+
We set the start date in the scoping call. If you start before 1 January 2027, you can still settle classification, roles and policy during the transition period. A later start is possible, in which case the obligations under Article 16 already apply during the project.
Read more
- DORA Article 16: the simplified ICT risk management framework
- DORA for factoring and leasing: obligations and evidence from 2027
- DORA gap analysis: quick check, Article 16 and full framework
- BAIT and DORA: repeal, transition and the mapping as Excel
- Classifying critical or important functions under DORA
- DORA incident reporting: classifying and reporting ICT-related incidents
- DORA scope: who does DORA apply to, and which framework?
- DORA compliance for smaller financial entities in Germany
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA), English version (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management, Title III simplified framework) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports) (retrieved 2026-11-06)
- Section 1a German Banking Act (KWG), German (retrieved 2026-11-06)
- Section 65a German Banking Act (KWG), German (retrieved 2026-11-06)
- BaFin news of 9 January 2025 on changes to IT requirements under DORA (German) (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA (PDF, German) (retrieved 2026-11-06)
- BaFin: Circular 06/2026 (BA) MaRisk, as of 30 June 2026 (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss your transition
Tell us briefly what kind of institution you are, how many employees you have, which BAIT documents exist and who runs your IT. In the initial call, by phone or video if you prefer, we clarify whether the service fits. In the subsequent scoping call we set scope, price and start date.