Last updated: 2026-11-06
This page applies to the full framework: insurance and reinsurance undertakings under Solvency II apply Articles 5 to 15 DORA. The simplified framework under Article 16 is not available to them. Article 16 applies to insurance holding companies (section below) and, outside Solvency II, to small institutions for occupational retirement provision (IORPs). Whether DORA applies to your organisation and under which framework is covered on our page on DORA applicability.
Who in the insurance sector does DORA apply to?
To every insurer under Solvency II, and under the full framework. DORA expressly lists insurance and reinsurance undertakings as financial entities (Article 2(1)(n)). There are also three special cases:
| Undertaking | DORA | Legal basis |
|---|---|---|
| insurance and reinsurance undertakings under Solvency II | full framework under Articles 5 to 15, plus Articles 28 to 30, incident reporting and testing | Article 2(1)(n) DORA |
| small insurers under Article 4 of the Solvency II Directive | DORA does not apply | Article 2(3)(b) DORA |
| insurance holding companies (Section 7 no. 31 of the German Insurance Supervision Act, VAG) and undertakings under Section 293(4) VAG | simplified framework under Article 16 | Section 293(5) VAG |
| insurance intermediaries | only large intermediaries (micro, small and medium-sized ones are exempt) | Article 2(3)(e) DORA, details on our page DORA for insurance intermediaries |
What has become of VAIT?
It no longer applies. BaFin repealed VAIT (its supervisory requirements for IT in insurance undertakings), together with KAIT and ZAIT (the counterparts for fund management companies and payment institutions), with effect from the end of 16 January 2025. As early as June 2024 it had stated that the requirements of BAIT (the banking counterpart) and VAIT are essentially reflected in the DORA full framework and in Articles 28 to 30. There is no further transition period. The details are set out in the European level 2 acts, for ICT risk management in Delegated Regulation (EU) 2024/1774 (RTS), see DORA Regulation.
There is no transition group as there is for BAIT (BAIT and DORA). “Repealed” means that VAIT no longer sets any express requirement. DORA still requires most of the tasks behind it, often in more detail.
Where do the VAIT chapters go?
Into the DORA full framework and RTS 2024/1774, chapter by chapter. The table follows the comparison in BaFin's supervisory notice of 8 July 2024 (as of June 2024), which compares Chapters 1 to 10 of BAIT and VAIT with the full framework and Articles 28 to 30. The chapter numbers are the same in both circulars, but some individual items differ: the information security officer is item 4.5 in VAIT and item 4.4 in BAIT. An item-by-item mapping for BAIT is available as an Excel file on our page BAIT and DORA. For insurers, this table shows the chapter level.
| VAIT chapter | DORA and RTS 2024/1774 | What changes according to BaFin | Evidence under DORA (our assessment) |
|---|---|---|---|
| 1 IT strategy | Article 6(8) (digital operational resilience strategy, DOR strategy) | DORA does not require an IT strategy as VAIT did. It requires the DOR strategy. Communicating the IT strategy (VAIT 1.5) has no counterpart. How the two strategies relate is explained on our page ICT risk management. | DOR strategy approved by the management body |
| 2 IT governance | Articles 5 and 6, RTS Article 2 | Considerably more tasks for the management body, an internal governance and control framework specifically for ICT risk. | rules of procedure, allocation of responsibilities, resolutions |
| 3 Information risk management | Articles 6 and 8, RTS Articles 3 to 5 | The focus shifts to ICT risk management. The information network (VAIT 3.4) and the protection needs assessment (VAIT 3.5) are replaced by ICT asset management and classification. | inventory of functions, information assets and ICT assets with classification |
| 4 Information security management | Article 6(4), Articles 13 and 14, RTS Article 27 | The ICT risk control function under Article 6(4) resembles the information security officer in position and independence, but is not designed identically. Training and communication are given more weight. | appointment of the control function, training records, report on the review of the framework |
| 5 Operational information security | Articles 9 and 10, RTS Articles 6, 7, 10 to 14, 22, 23 | Much more detailed: network security, encryption also of data in use, timely detection and handling of vulnerabilities. | policies under the RTS, scan and patch reports |
| 6 Identity and access management | RTS Articles 18, 20 and 21 | Explicit requirements for identity management, “need-to-use” principle. | access control procedures, recertifications |
| 7 IT projects and application development | RTS Articles 15 to 17 | More detailed security-related requirements. The materiality threshold in change management no longer applies. | project and change procedures for all changes |
| 8 IT operations | Articles 7, 8, 9 and 12, RTS Articles 4, 5, 8, 9, 17 | Stronger operational stability, classification of systems, segregated data storage and reconciliation of backups. | operating procedures, capacity planning, backup policy with restoration tests |
| 9 Outsourcing of IT services and other service relationships in the area of IT services | Articles 28 to 30, Delegated Regulations (EU) 2024/1773 and 2025/532 | Much broader scope than the concept of outsourcing, more mandatory contract content, new rules on subcontracting. The outsourcing rules of MaGo (BaFin's minimum requirements for the system of governance of insurers) apply in parallel. | register of information, policy on ICT services, contracts under Article 30 |
| 10 IT contingency management | Articles 11, 12 and 14, RTS Articles 24 to 26 | New: the ICT business continuity policy, ICT response and recovery plans in place of the IT contingency plans, testing at least annually and a crisis management function. | policy, BIA, plans, test reports |
The supervisory notice deals with Chapters 3 and 4 in one section, the split into two rows is ours. What the contract content under Article 30 requires in detail is covered on our page Managing ICT third-party service providers, and the structure of the register on our page Register of information.
MaGo and DORA: who governs what?
DORA governs ICT risk, MaGo the general system of governance, and both apply side by side. For insurers under Solvency II, the relevant circular is Circular 09/2025 (VA) “MaGo für SII-VU” of 14 July 2025, in force since 14 October 2025. It replaced Circular 02/2017 (VA), according to BaFin without fundamental changes in substance.
MaGo itself describes the relationship (margin no. 11): DORA and the AI Act set sector-specific requirements for ICT and AI risks, while MaGo interprets the general governance processes. Where the general system of governance is concerned, “the interpretative guidance in this circular remains authoritative” (our translation). MaGo für SII-VU does not apply to death benefit funds (Sterbekassen), Pensionskassen and small insurance undertakings under Section 211 VAG (margin no. 2). Institutions for occupational retirement provision have their own MaGo, which we do not cover here.
| Topic | MaGo für SII-VU | DORA | What it means in practice |
|---|---|---|---|
| Responsibility | overall responsibility of the management board (Chapter 5) | The management body defines, approves, oversees and is responsible for the ICT risk management framework (Article 5(2)) | ICT resolutions in the same bodies and minutes as the rest of the system of governance |
| Automated business processes | document processes such as automated underwriting or claims decisions in an identifiable way, with options to intervene and independent assessment (margin nos. 79 to 81) | The ICT systems behind them belong in the ICT risk management framework | Flag automated processes in the inventory and link them to the supporting systems |
| Key tasks | Undertakings may designate further key tasks, MaGo names IT security as an example (margin no. 82) | ICT risk control function with an appropriate level of independence (Article 6(4), not for microenterprises) | Align the MaGo role and the DORA function, avoid duplicate staffing or a gap |
Contingency management (Chapter 14) and outsourcing (Chapter 13) follow in separate sections. Banks face the same question with MaRisk (Minimum Requirements for Risk Management), see MaRisk and DORA.
How do MaGo contingency management and DORA fit together?
Best as one system with an ICT part. MaGo Chapter 14 requires contingency management for which the management board is responsible. The management board as a whole adopts the contingency planning (margin no. 252). Contingency plans are needed for every area and process whose unforeseen disruption could jeopardise the continuation of business, with tolerable outage and recovery times, covering outsourced areas and with regular test runs and exercises (margin no. 253). The scenarios follow the individual risk profile (margin no. 254).
Under the full framework, DORA requires an ICT business continuity policy, which may be adopted as an integral part of the overall business continuity policy (Article 11(1)), plus response and recovery plans, a business impact analysis, testing at least annually and a crisis management function (Article 11(3), (5), (6), (7)), and recovery objectives for each function (Article 12(6)). The response and recovery plans are the counterpart of the IT contingency plans from VAIT Chapter 10.
Our recommendation follows from this: contingency planning under MaGo remains the umbrella, and the ICT business continuity policy becomes part of it. Both use the same BIA and the same outage and recovery times, and the exercises under margin no. 253 and the tests under Article 11(6) are planned together.
Outsourcing and ICT third-party service providers: what applies twice?
Many contracts fall under both sets of rules, some under only one. MaGo Chapter 13 governs the outsourcing of functions and insurance activities under Section 32 VAG. Among those usually regarded as important are policy administration, claims handling, accounting, investment and asset management, and electronic data processing in relation to insurance-specific activities that are themselves important (margin no. 218). Such outsourcing requires, among other things, prior approval by the management board as a whole, notification under Section 47 no. 8 VAG and separate contingency plans.
DORA, by contrast, covers every contractual arrangement for ICT services. According to BaFin, this concept is much broader than the concept of outsourcing, and all third-party relationships with an ICT element must be assessed. The MaGo outsourcing rules apply in parallel and in addition, and many ICT contracts are also outsourcing arrangements and vice versa. Whether an ICT service supports a critical or important function is, in terms of method, a different question from whether an important function or insurance activity within the meaning of the VAG is involved (supervisory notice of 8 July 2024, section 6.1). How to classify critical or important functions is shown on our page Critical or important functions.
For the organisation this means: according to BaFin, the role for monitoring ICT contracts under Article 5(3) DORA is comparable to the (central) outsourcing officer. Instead of creating a second office, you can assign the task to the outsourcing officer as well, or designate a member of senior management, as Article 5(3) allows.
What applies to insurance holding companies?
The simplified framework under Article 16. Insurance holding companies under Section 7 no. 31 VAG and undertakings under Section 293(4) VAG whose main business is acquiring and holding participations in insurers or pension funds (Pensionsfonds) and which are not yet supervised under the VAG apply DORA, but Article 16 instead of Articles 5 to 15 (Section 293(5) VAG). The VAG sets no transition period for this. What the simplified framework requires is set out on our page DORA Article 16. For the rest of the system of governance, MaGo applies to holding companies directly or by analogy, depending on their activity (margin no. 4).
Example: transition plan for an insurer
Fictitious example, not a client: Muster-Versicherung AG is a regional property and casualty insurer under Solvency II with 140 employees, so it is not a microenterprise. The register of information and the main policies have been in place since January 2025, but many documents still follow the VAIT structure. In November 2026 it draws up a transition plan. Policy administration runs as a cloud service from a software company, the data centre is operated by an external IT service provider, and its investments are managed by a fund management company.
Transition plan VAIT/MaGo → DORA (template, filled in with fictitious data, as of 6 November 2026):
| Document from the VAIT era | What it becomes | Legal basis | Responsible | Evidence | by |
|---|---|---|---|---|---|
| IT strategy (VAIT 1) | remains as the link to the business strategy, is supplemented with the content of the DOR strategy and kept in one document with it | Article 6(8) DORA | board member for operations and IT | board resolution | Dec 2026 |
| Information security guideline and policies (VAIT 4) | content remains, structure follows RTS Title II Chapter I, document map old → new | RTS Articles 2 to 14 | information security | document map, approved policies | Mar 2027 |
| Information network, protection needs assessment (VAIT 3.4, 3.5) | move into the inventory of information assets and ICT assets with classification, linked to the list of functions | Article 8(1) DORA, RTS Articles 4 and 5 | IT operations with the business units | inventory with classification | Mar 2027 |
| Information security officer (VAIT 4.5), designated as the key task IT security | role remains. The tasks of the ICT risk control function are explicitly assigned to it or staffed separately, and its independence is documented | Article 6(4) DORA, MaGo margin no. 82 | management board | job description, organisation chart | Dec 2026 |
| Authorisation concept (VAIT 6) | remains, supplemented with identity management and need-to-use | RTS Articles 20 and 21 | information security | recertification records | Jun 2027 |
| Change procedure (VAIT 7, 8) | applies to all changes to ICT systems, without a materiality threshold | RTS Article 17 | IT operations | change log | Mar 2027 |
| Backup concept (VAIT 8) | becomes the backup policy, restoration from segregated storage is tested | Article 12 DORA | IT operations | policy, test record | Jun 2027 |
| IT contingency concept and IT contingency plans (VAIT 10), contingency plans under MaGo | one business continuity policy with an ICT part, one shared BIA, ICT response and recovery plans, crisis management function designated | Article 11(1), (3), (5), (7) DORA, MaGo margin nos. 251 to 256 | contingency management | policy, BIA, exercise report | Mar 2027 |
| Outsourcing list and outsourcing policy (VAIT 9, MaGo Chapter 13) | remain. Each arrangement is flagged “outsourcing” and “ICT service”, and the list is reconciled with the register of information | MaGo margin no. 222 (policy), Article 28(3) DORA | outsourcing officer | reconciled lists | Dec 2026 |
| Outsourcing officer | additionally and explicitly takes on the monitoring of all ICT contracts | Article 5(3) DORA, MaGo margin no. 225 | management board | resolution, task description | Dec 2026 |
No row removes a safeguard: each document gets a new legal basis or a new shape. Reconciling the three providers shows three cases. The cloud policy administration is the outsourcing of an important insurance activity under MaGo and at the same time an ICT service that, according to the undertaking's classification, supports a critical or important function: notification, register entry and contract content under Article 30(3) apply side by side. The data centre operation is an ICT service. In our reading, because it supports important insurance-specific activities, it is usually also the outsourcing of an important function (MaGo margin no. 218 on the importance of electronic data processing). Muster-Versicherung checks in the individual case whether this is outsourcing under Section 32 VAG. Investment management is usually the outsourcing of an important function under MaGo. If it is a regulated financial service, BaFin does not treat it as an ICT service within the meaning of Article 3(21) DORA.
Three typical gaps
| Gap | Cause | Effect | Remedy |
|---|---|---|---|
| MaGo contingency planning and ICT business continuity kept separately | Contingency management under MaGo Chapter 14 sits with corporate planning and control, the former IT contingency management from VAIT 10 sits in IT. Each maintains its own business impact analysis. | Two different outage and recovery times apply to the same process (MaGo margin no. 253 versus Article 11 and Article 12(6) DORA). Exercises and tests run separately, and in an emergency it is unclear which plan applies. | One shared BIA, the ICT business continuity policy as part of contingency planning (Article 11(1)) and a joint exercise and test plan. |
| Nobody in charge of monitoring ICT contracts | The outsourcing officer only looks after outsourcing under Section 32 VAG. | ICT contracts that are not outsourcing, such as software with maintenance or intra-group IT, are monitored by nobody, although Article 5(3) DORA requires it. | Assign the task under Article 5(3) explicitly, to the outsourcing officer or to a member of senior management. |
| Outsourcing notification without a DORA pre-check | New providers go through the MaGo process with risk analysis and notification under Section 47 no. 8 VAG. | The assessment before entering into the contract under Article 28(4) DORA and the mandatory content under Article 30 are missing, and the contract has to be renegotiated. | One joint review step in procurement: MaGo risk analysis and DORA pre-check in one form. |
The example, transition plan and gaps are our professional assessment based on the wording of DORA, MaGo and BaFin's supervisory notices. Whether a particular arrangement is outsourcing under Section 32 VAG is, in case of doubt, a question for your legal counsel.
How we help
We worked on the DORA programme of a large German insurance group (on behalf of an international management consultancy, 02/2024-10/2025). For insurers we start with the DORA gap analysis for the full framework: it shows where VAIT-era documents, MaGo and DORA still diverge, and ends with an action plan. Insurance holding companies under the simplified framework start with the Article 16 gap analysis.
Frequently asked questions
Does VAIT still apply?+
Does the simplified framework under Article 16 apply to smaller insurers?+
What does “MaRisk VA” refer to?+
Do insurers still need an information security officer under DORA?+
Read more
- DORA scope: who does DORA apply to, and which framework?
- BAIT and DORA: repeal, transition and the mapping as Excel
- ICT risk management under DORA: framework and DOR strategy
- Classifying critical or important functions under DORA
- DORA Article 16: the simplified ICT risk management framework
- DORA for insurance brokers and intermediaries: who is in scope
- DORA gap analysis: quick check, Article 16 and full framework
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 2, 4, 5, 6, 11, 12, 16, 28 to 30, German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management), Title II, German version (retrieved 2026-11-06)
- BaFin: news of 9 January 2025 on changes to IT requirements under DORA (repeal of KAIT, VAIT, ZAIT), in German (retrieved 2026-11-06)
- BaFin: supervisory notice of 8 July 2024 (as of June 2024) on implementing DORA in ICT risk management and ICT third-party risk management, sections II.1 to II.8, in German (retrieved 2026-11-06)
- BaFin: Circular 09/2025 (VA) MaGo für SII-VU of 14 July 2025, margin nos. 2, 4, 11, 79 to 82, 200 to 228, 249, 251 to 256, in German (retrieved 2026-11-06)
- BaFin: article of 14 July 2025 on the updated MaGo circular, in German (retrieved 2026-11-06)
- German Insurance Supervision Act (VAG), Section 293(4) and (5) (unofficial version, in German) (retrieved 2026-11-06)
- BaFin: DORA FAQs (scope, ICT third-party risk management), in German (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).