Last updated: 2026-11-06
In short: micro, small and medium-sized intermediaries are exempt. Large intermediaries have applied DORA under the full framework since 17 January 2025, and the simplified framework under Article 16 is not open to them. “Indirect DORA obligations” for exempt intermediaries appear neither in the regulation nor in the publications of BaFin, the German financial supervisor, that we have read. This page covers intermediaries only. For insurance undertakings, see our page VAIT and DORA.
What does DORA say about insurance intermediaries?
Two provisions in Article 2 DORA decide. Under paragraph 1, point (o), “insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries” are in principle financial entities. Under paragraph 3, point (e), however, the regulation does not apply to such intermediaries “which are microenterprises or small or medium-sized enterprises”. BaFin repeats the exemption word for word. Recital 39 gives the reason: the regulation acknowledges the specificities of the insurance intermediation market structure.
DORA takes the definition of an insurance intermediary from the Insurance Distribution Directive (EU) 2016/97 (Article 3 DORA, referring to its Article 2(1), points (3) to (5)). Article 2 DORA does not distinguish between brokers, multiple agents and tied agents. For the exemption, only size counts.
Where does the size threshold lie?
DORA defines the size classes itself in Article 3, by reference to the financial entity:
| Class | Provision | Employees | Turnover and balance sheet total |
|---|---|---|---|
| microenterprise | Article 3(60) | fewer than 10 | annual turnover and/or annual balance sheet total not exceeding EUR 2 million |
| small enterprise | Article 3(63) | 10 to 49 | annual turnover and/or annual balance sheet total exceeding EUR 2 million, but not exceeding EUR 10 million |
| medium-sized enterprise | Article 3(64) | fewer than 250, not a small enterprise | annual turnover not exceeding EUR 50 million and/or annual balance sheet not exceeding EUR 43 million |
Because all three classes are exempt, on our reading only the threshold for medium-sized enterprises matters. An intermediary is in scope if it employs 250 or more persons. Below 250 employees it depends on the financial thresholds, and there the wording is not clear. If “and/or” is read so that meeting one threshold is enough, an intermediary only counts as large once turnover exceeds EUR 50 million and balance sheet total exceeds EUR 43 million. If it is read so that both thresholds must be met, exceeding one is already enough. If your firm falls between these readings, have the classification clarified legally.
The wording of Article 3 does not expressly answer two further questions: whether employees and figures of affiliated companies count, and which reference date applies. If your intermediary firm belongs to a group, that also belongs in the legal review. How the size classes work for other financial entities is explained on our page DORA applicability.
Check scheme in three questions
The scheme is a recommendation by Blackfort Technology. It gives an orientation but does not replace a legal review of the individual case. Record the result with the date and the figures used.
| Question | Basis | If yes | If no |
|---|---|---|---|
| 1. Are you an insurance intermediary, reinsurance intermediary or ancillary insurance intermediary? | Article 2(1)(o), Article 3 DORA with Directive (EU) 2016/97 | continue with question 2 | DORA does not cover you as an intermediary. Check any other licences separately |
| 2. Are you a micro, small or medium-sized enterprise? | Article 2(3)(e), Article 3(60), (63), (64) | exempt, DORA does not apply to you | DORA applies under the full framework |
| 3. Do you yourself provide ICT services to financial entities? | Article 3(19) and (21) | To that extent you are an ICT third-party service provider. Requirements come through these clients’ contracts | no consequences from DORA through your role as a service provider |
Example: two completed check records
Fictitious examples, not clients.
| Muster-Maklerhaus GmbH | Muster-Vertriebs AG | |
|---|---|---|
| Business | insurance broker for commercial clients | sale of insurance through its own field sales organisation |
| Figures (last annual accounts) | 85 employees, turnover EUR 14 million, balance sheet total EUR 9 million | 320 employees, turnover EUR 61 million, balance sheet total EUR 38 million |
| Question 1 | yes, insurance intermediary | yes, insurance intermediary |
| Question 2 | yes, medium-sized enterprise: fewer than 250 employees, both financial thresholds met. The reading of “and/or” makes no difference | no: 250 employees or more. The financial thresholds do not matter |
| Question 3 | no: uses insurers’ portals and rate calculators and a purchased broker management system, provides no ICT services itself | no: runs its own IT for itself only |
| Result | DORA does not apply. Next check with the next annual accounts | DORA has applied under the full framework since 17 January 2025. Check obligations and implementation status |
Does using an insurer’s IT turn intermediaries into ICT service providers?
No. An ICT third-party service provider is an undertaking providing ICT services (Article 3(19)). An intermediary using an insurer’s portals, rate calculators or interfaces is a user of these services. We have found no rule in DORA, the Level 2 acts or BaFin’s publications under which an intermediary becomes an ICT third-party service provider as a result, or has “indirect DORA obligations” (as of 6 November 2026). This says nothing about individual contracts between insurers and intermediaries. If an insurer requires certain security measures by contract, that contract is the basis.
The position is different where an intermediary itself operates ICT services for a financial entity, for example a platform an insurer uses for its processes. To that extent it is an ICT third-party service provider, and the insurer has to include the requirements of Articles 28-30 in the contract. What that means for you is described on our page DORA for ICT service providers.
What applies to large intermediaries?
Large intermediaries are financial entities within the meaning of DORA and apply the full framework. This includes ICT risk management under Articles 5-15, the classification and reporting of major ICT-related incidents, digital operational resilience testing and the management of ICT third-party risk with a register of information. How incidents are classified and reported is described on our page DORA incident reporting, managing providers on our page ICT third-party service providers. An overview of all obligations with their provisions is on our page DORA requirements.
Exempt intermediaries keep everything else they already had to observe, such as data protection and the agreements with their insurers. Whether NIS2 applies to an intermediary firm is a separate question that you can check on nis2-readiness.de (in German).
Three typical misjudgements
| Misjudgement | Cause | Effect | Remedy |
|---|---|---|---|
| “We work with insurers, so DORA applies to us” | Requests from insurers or general notices are read as a DORA obligation. | Effort on documents nobody requires. The actual basis, the contract with the insurer, is not checked. | Apply the check scheme and assign each requirement to its legal basis: law, contract or own decision. |
| Group not considered | The intermediary company belongs to a sales or insurance group, but only its own figures are checked. | The open question whether affiliated companies count goes unnoticed. If the group is above the threshold, the classification can tip without anyone noticing. | Record group membership and the figures of affiliated companies in the check record and have the question clarified legally. |
| Classification checked once and forgotten | The check was done in 2024 or 2025 and not repeated. | Growth, acquisitions or a merger push the firm over the threshold unnoticed, and the obligations then apply without lead time. | Renew the check record with every set of annual accounts and with every restructuring. |
How we help
If your intermediary firm is in scope, our DORA gap analysis shows what is missing under the full framework and what comes first. If you are close to the size thresholds, we record figures and evidence with you. We flag borderline cases for your legal counsel, who decides the individual case.
Frequently asked questions
Does DORA apply to tied agents and exclusive agents?+
What about firms that only sell insurance on the side?+
Do we as brokers have to report ICT incidents under DORA?+
An insurer asks us for information on IT security “because of DORA”. Do we have to answer?+
Does the simplified framework under Article 16 apply to insurance intermediaries?+
Read more
Sources
- Regulation (EU) 2022/2554 (DORA), German version, recital 39, Article 2(1)(o) and (3)(e), Article 3(19), (21), (60), (63), (64), Article 16 (retrieved 2026-11-06)
- Regulation (EU) 2022/2554, English version (Article 3(60), (63), (64) “and/or”) (retrieved 2026-11-06)
- BaFin: DORA FAQ on scope (exemptions under Article 2(3)), in German (retrieved 2026-11-06)
- BaFin: DORA FAQs (overview page), in German (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).