DORA level 2 map: every RTS, every ITS and the guidelines

What counts as level 2, and how binding is it?

Level 2 consists of the legal acts with which the Commission supplements DORA on the basis of specific empowerments in the regulation. Delegated regulations and implementing regulations apply directly, just like DORA. What RTS and ITS are and which acts matter most to most financial entities is covered in the legal overview on the page DORA regulation. This page adds the complete list with official reference, related articles and framework.

BaFin, the German financial supervisor, does not issue its own circulars specifying DORA. The reason is also given on the page DORA regulation. Alongside the regulations there are two joint guidelines of the European Supervisory Authorities (ESAs). How binding they are is answered in the questions below.

How did we check the list?

On 6 November 2026, we queried the Official Journal of the EU (Cellar database) for all legal acts based on DORA. The result is exactly the twelve acts below. We read title, date, publication and empowerment in the German official text. No amending act is recorded for DORA or the twelve acts. There are corrigenda, however, and four of them affect the German version (table further below).

All delegated and implementing regulations enter into force on the twentieth day after their publication in the Official Journal. Delegated Regulation 2024/1502 contains an exception with a later date: the lead overseer applies sub-criterion 1.4 only from 16 January 2025.

The map: all level 2 texts by DORA chapter

How to read the tables: “adopted” is the date of the act, “OJ” the date of publication in the Official Journal. “Basis” is the empowerment on which the act itself relies, as cited in its preamble. Article 20 has no numbered paragraphs, so the acts based on it cite it by position, as the third subparagraph or the fourth paragraph (the German version counts them as paragraphs 3 and 4). “KWG group” means the institutions under Section 1a(2a) of the German Banking Act (KWG), such as factoring and leasing firms. “Specifies” names the DORA articles whose obligations the act fills in. The number links to the German version on EUR-Lex, where the language can be switched.

Chapter II: ICT risk management

Chapter III: ICT-related incidents

Chapter IV: Digital operational resilience testing

Chapter V Section I: ICT third-party risk

Chapter V Section II: Oversight framework for critical ICT third-party service providers

Joint guidelines of the ESAs

According to the ESAs’ compliance table, BaFin applies guideline JC 2024 34. On 6 November 2026, we did not find a separate list of adopted guidelines on BaFin’s website.

Which corrigenda affect the German text?

A corrigendum corrects the wording of one or more language versions and applies as if the text had been correct from the start. As with the column codes of the register of information, this can change what institutions submit. Anyone working with an older copy or an early extract reads the wrong wording. The Official Journal lists these four corrigenda for the German version:

Other corrigenda only affect other language versions, for example the French version of the reporting regulations 2025/301 and 2025/302.

Example: Muster-Factoring GmbH filters the map

Fictitious example, not a client. Muster-Factoring GmbH (23 staff, EUR 61 million total assets) applies the simplified framework under Article 16 from 1 January 2027, and incident reporting since 17 January 2025 (Section 1a(2a) in conjunction with Section 65a(3) KWG). For its register of applicable rules, the compliance officer goes through the map row by row:

The result is six legal acts with official reference, status and corrigenda in the register of applicable rules. For the internal policies, the compliance officer decides that they will only cite the version published in the Official Journal from now on. Which obligations follow in detail is shown in the obligations matrix and on the page on Article 16.

Three typical gaps in handling level 2

How we help

We compare your policies and evidence with the level 2 texts that apply to your framework and record reference and status. The starting point is the DORA gap analysis. Institutions of the KWG group moving from BAIT to the simplified framework on 1 January 2027 find the matching service in our transition from BAIT.