KAIT and DORA: mapping, KAMaRisk draft and transition plan

Last updated: 2026-11-06

This page applies to the full framework: licensed fund management companies (Kapitalverwaltungsgesellschaften, KVG) apply Articles 5 to 15 DORA. The simplified framework under Article 16 is not available to them, and BaFin, the German financial supervisor, expressly names former KAIT addressees as not covered. Whether and under which framework DORA applies to your company is covered on the page DORA applicability.

Which fund management companies does DORA apply to?

To UCITS management companies and AIF management companies under the full framework, except small AIF managers:

Company	DORA	Basis
UCITS management company (management company under the UCITS Directive)	full framework under Articles 5 to 15, plus Articles 28 to 30, incident reporting and testing	Article 2(1)(l), Article 3(45) DORA
licensed AIF management company	full framework as above	Article 2(1)(k), Article 3(44) DORA
small AIF managers under Article 3(2) of the AIFM Directive	DORA does not apply	Article 2(3)(a) DORA
KVG that is a microenterprise	full framework with some relief	Article 3(60) DORA, check on the page DORA applicability

For registered KVGs under Section 44 of the German Capital Investment Code (KAGB), which the KAIT did not cover, the answer is in the questions below.

What has become of the KAIT?

It no longer applies. BaFin repealed the KAIT (Circular 11/2019 (WA) as amended on 1 October 2019) together with the VAIT and ZAIT at the end of 16 January 2025, with no further transition period. According to BaFin’s information letter of 19 December 2024, DORA essentially covers the previous IT requirements. There is no transition group for KVGs like the one for the BAIT (BAIT and DORA).

“Repealed” means: no express KAIT requirement any more. The obligations behind it remain in the law: Section 28(1) no. 5 KAGB requires appropriate control and security arrangements for data processing in line with DORA. The detail comes from the level 2 acts, above all Delegated Regulation (EU) 2024/1774 (DORA regulation).

Where do the KAIT chapters go?

Into the full framework of DORA, RTS 2024/1774 and Articles 28 to 30. BaFin has not published its own comparison of the KAIT with DORA. Its supervisory notice of 8 July 2024 compares BAIT and VAIT chapter by chapter and states that the requirements of the KAIT are “comparable in many cases, so that the results can generally be transferred” (our translation). On this basis, the table transfers the mapping to the eight chapters of the KAIT. The mapping is ours, the ranges of numbered paragraphs (Tz.) come from the KAIT text. A mapping paragraph by paragraph is available as an Excel file only for the BAIT, on the page BAIT and DORA.

Mapping of the eight KAIT chapters to DORA. On the left the KAIT chapters, on the right the building blocks of the full framework: chapter 1 IT strategy to the DOR strategy under Article 6(8). Chapter 2 IT governance to management body and framework under Articles 5 and 6 and RTS Article 2. Chapter 3 information risk management to the identification and classification of functions and assets under Articles 6 and 8 and RTS Articles 3 to 5. Chapter 4 information security management to the ICT risk control function and review report under Article 6(4), Articles 9 and 13 and RTS Articles 2 and 27. Chapter 5 user access management to identity management, access control and logging under RTS Articles 12, 20 and 21. Chapter 6 IT projects and application development to projects, development and change management under RTS Articles 15 to 17. Chapter 7 IT operations including data backup to operations, capacity and backup under Articles 7, 8, 9 and 12 and RTS Articles 8 to 10. Chapter 8 outsourcing and other external procurement to ICT third-party risk under Articles 28 to 30. A dashed box on the right without a counterpart on the left: response and recovery under Articles 11 and 12, because the KAIT had no chapter of its own on emergency management and covered emergency measures only in Tz. 15. At the bottom a bar: the KAMaRisk with the emergency concept (8.2) and outsourcing (10) and Section 36 KAGB apply alongside. — Tap the graphic to open it at full size.Where the KAIT chapters go. Source: KAIT (Circular 11/2019 (WA)), BaFin supervisory notice of 8 July 2024 (mapping for BAIT and VAIT, transferred to the KAIT by us), KAMaRisk (Circular 01/2017 (WA)). Own illustration.

KAIT chapter (Tz.)	DORA and RTS 2024/1774	What changes	Evidence under DORA (our assessment)
1 IT strategy (1 to 5)	Article 6(8)	The KAIT required an IT strategy with six minimum contents. DORA requires a digital operational resilience strategy (DOR strategy) as part of the framework. How the two relate is explained on the page ICT risk management.	DOR strategy with management board resolution
2 IT governance (6 to 15)	Articles 5 and 6, RTS Article 2	The management body is responsible for the entire ICT risk management framework and keeps its ICT knowledge up to date through training. The emergency measures from Tz. 15 move into Article 11.	allocation of tasks, resolutions, training records of the management board
3 Information risk management (16 to 23)	Articles 6 and 8, RTS Articles 3 to 5	The information network and the protection requirements assessment become the identification and classification of all ICT-supported business functions and of the information assets and ICT assets, reviewed at least once a year.	inventory of functions and assets with classification
4 Information security management (24 to 31)	Article 6(4), Articles 9 and 13, RTS Articles 2 and 27	DORA does not mention the information security officer. According to BaFin, the ICT risk control function is similar but broader in scope. Instead of the quarterly report of the information security officer (Tz. 31), DORA provides for the report on the review of the framework (Article 6(5), RTS Article 27).	appointment of the control function, information security policy, review report
5 User access management (32 to 40)	RTS Articles 12, 20 and 21	Express requirements on identity management and access control with the need-to-use principle. The logging from Tz. 39 is found in the logging requirements of RTS Article 12.	access control procedures, recertifications, log reviews
6 IT projects, application development, including by end users in the business units (41 to 55)	RTS Articles 15 to 17	More detailed requirements on projects and development, change management for all ICT systems. DORA has no specific rules on end-user computing (IDV), and on our reading the business units’ applications are information assets and ICT assets.	project and change procedures, asset inventory including end-user computing
7 IT operations, including data backup (56 to 62)	Articles 7, 8, 9 and 12, RTS Articles 8 to 10	Operations, capacity, vulnerabilities and patches in detail. The data backup concept becomes the backup policy with restoration on separate systems.	operating procedures, capacity planning, backup policy, test records
8 Outsourcing and other external procurement of IT services (63 to 68)	Articles 28 to 30, Delegated Regulations (EU) 2024/1773 and 2025/532	Every arrangement on ICT services, with register of information, assessment before contract signature and mandatory contract contents. Section 36 KAGB applies alongside, see below.	register of information, policy on ICT services, contracts under Article 30

Three BAIT chapters are missing from the KAIT: operational information security, IT emergency management and critical infrastructures. For DORA, emergency management matters most. The KAIT covered emergency measures only in Tz. 15, and otherwise referred to the emergency concept under section 8.2 KAMaRisk (Tz. 6). This is where DORA requires the most in addition (Articles 11 and 12), details on the page ICT business continuity.

Which KAMaRisk apply, and what would the draft change?

The KAMaRisk as amended on 10 January 2017 apply (Circular 01/2017 (WA)). They specify requirements of the AIFMD Level 2 Regulation on organisation, risk management and outsourcing. The KAIT had only specified the IT requirements of the KAMaRisk and expressly left them unaffected (KAIT, preliminary remarks, Tz. 2). With the KAIT, this specification has gone, but the IT provisions of the KAMaRisk remain in the circular.

On 12 June 2026, BaFin put an amended version out for consultation (consultation 06/2026), with comments possible until 1 July 2026. According to BaFin, the main reason is the Fund Risk Limitation Act (Fondsrisikobegrenzungsgesetz), which implements AIFMD II, and the draft also removes duplications with DORA. A final version had not been published by 6 November 2026. The middle column therefore only shows a draft, and the 2017 version continues to apply.

Provision	Version in force (10 January 2017)	Draft of 12 June 2026 (not in force)	What this means alongside DORA (our assessment)
4.1 Tz. 3, material risks	operational risks including legal and reputational risks	ICT risks are expressly named as part of operational risks	ICT risks already belong in the risk inventory today. The ICT risk management framework under Article 6 supplies their assessment.
8.1 Electronic data processing	Tz. 1 and 2: suitable systems according to business and risk. Tz. 3 to 5: protection objectives, standards, access rights, testing, acceptance and approval	Tz. 3 to 5 deleted. Tz. 1 and 2 are not in the overview of changes.	DORA and the RTS regulate the deleted content in more detail, for example access control (RTS Article 21) and change management (RTS Article 17).
8.2 Emergency concept	emergency concept under Article 57(3) of the AIFMD Level 2 Regulation, coordinated concepts when time-critical processes are outsourced, plans for a change of depositary	not in the overview of changes	The emergency concept stays, and ICT business continuity under Article 11 becomes its ICT part. The plan for a change of depositary has no counterpart in DORA and remains separate.
10 Outsourcing	outsourcing and its distinction from other external procurement, without reference to DORA	renamed from “Outsourcing” to the German term “Auslagerung”. New: ICT services under Article 3(21) DORA that are subject to Articles 28 to 30 fall outside the scope of section 10	For ICT services, the KAMaRisk would step back, like AT 9 of the MaRisk, BaFin’s risk management requirements for banks (MaRisk and DORA). The draft does not change Section 36 KAGB itself.

Our recommendation until the final version: do not delete anything from your own documents just because the draft deletes a provision.

Outsourcing under the KAGB and ICT providers under DORA: what applies twice?

Many contracts fall under both sets of rules, some under only one. Section 36 KAGB governs the outsourcing of a KVG’s tasks: conditions such as qualification, monitoring, rights to give instructions and to terminate, and a notification to BaFin before the outsourcing agreement takes effect (Section 36(2)). The KAMaRisk specify this in section 10. Other external procurement of IT services was governed by chapter 8 of the KAIT.

DORA covers every contractual arrangement on ICT services, whether outsourcing or not. Each contract therefore raises two separate questions: is it outsourcing under Section 36 KAGB? Is it an ICT service under Article 3(21) DORA, and does it support a critical or important function? How to classify functions is shown on the page Critical or important functions, how to build the register on the page Register of information, and the contract contents on the page Managing ICT third-party risk.

Article 5(3) DORA helps with the organisation: KVGs that are not microenterprises set up a role to monitor the arrangements on ICT services or designate a member of senior management for it. The existing outsourcing management, which already handles the notifications under Section 36 KAGB, can take on this task.

Example: transition plan for a fund management company

Fictitious example, not a client. Muster-KVG mbH has 42 employees, manages special AIFs and is licensed as an AIF management company. With 42 employees, it is not a microenterprise. The register of information has been in place since 2025, but many documents still follow the structure of the KAIT. Which obligations it tackles first is shown on the page DORA requirements. It obtains its portfolio management system as a cloud service, an external IT provider runs the data centre, and fund accounting is done in-house.

Transition plan KAIT → DORA (template, filled in for a fictitious company, as of 6 November 2026):

Document from the KAIT era	What it becomes	Basis	Responsible	Evidence	by
IT strategy (KAIT Tz. 1 to 5)	remains the link to the business strategy, is extended by the contents of the DOR strategy and kept with it in one document	Article 6(8) DORA	management board	management board resolution	12/2026
information security officer (KAIT Tz. 27 to 31), so far reporting to the head of IT	the role stays. The tasks of the ICT risk control function are expressly assigned to it, and the reporting line goes directly to the management board	Article 6(4) DORA	management board	job description, organisation chart	12/2026
information network and protection requirements assessment (KAIT Tz. 19 to 21)	move into the inventory of functions, information assets and ICT assets with classification	Article 8(1) and (4) DORA, RTS Articles 4 and 5	head of IT with the business units	inventory with classification	03/2027
end-user computing register (KAIT Tz. 55), including the Excel workbook for checking unit prices	becomes part of the asset inventory, each application with classification and a responsible person	Article 8(1) DORA (our reading)	fund accounting, information security	inventory extract	03/2027
access rights concept with recertification (KAIT chapter 5)	stays, extended by identity management and need-to-use	RTS Articles 20 and 21	information security	recertification records	06/2027
change procedure (KAIT Tz. 59 and 60)	applies to all changes to ICT systems	RTS Article 17	head of IT	change log	03/2027
data backup concept (KAIT Tz. 62)	becomes the backup policy, restoration on separate systems is tested	Article 12 DORA	head of IT	policy, test record	06/2027
emergency concept under KAMaRisk 8.2 with the emergency measures under KAIT Tz. 15	remains the umbrella. New: ICT business continuity policy, BIA, response and recovery plans, crisis management function. The plan for a change of depositary stays unchanged	Article 11 and Article 12(6) DORA, KAMaRisk 8.2	management board, emergency management officer	policy, BIA, exercise report	03/2027
overview of contracts for other external procurement (KAIT Tz. 66) and list of outsourcing arrangements	are reconciled with the register of information. Each contract is flagged “outsourcing under Section 36 KAGB” and “ICT service”	Article 28(3) DORA, Section 36 KAGB	outsourcing management	reconciled lists	12/2026
risk assessment before any external procurement (KAIT Tz. 65)	becomes the assessment before contract signature, in one form together with the outsourcing assessment	Article 28(4) DORA	procurement, outsourcing management	assessment form	12/2026

No row removes a safeguard or a role: each document gets a new basis or a new shape. In the contract reconciliation, the portfolio management system as a cloud service is both outsourcing under Section 36 KAGB and an ICT service for a critical or important function, so notification, register entry and the contract contents under Article 30(3) apply side by side.

Three typical gaps

Gap	Cause	Effect	Remedy
Emergency concept without ICT business continuity	The KAIT had no chapter of its own on emergency management. After the repeal, the emergency concept under KAMaRisk 8.2 was considered complete.	Business impact analysis, recovery objectives per function, annual tests and the crisis management function under Articles 11 and 12 are missing.	Add an ICT business continuity policy to the emergency concept as part of it (Article 11(1)), and keep BIA and test plan together.
KAMaRisk draft treated as in force	After the consultation, policies were already shortened in line with the draft of 12 June 2026.	For the 2017 version in force, there is no evidence on 8.1 Tz. 3 to 5, for example on access rights and acceptance.	Keep the content under the DORA structure, with a reference to 8.1 Tz. 3 to 5. Implement the draft only once the final version is out.
End-user computing applications missing from the ICT inventory	The end-user computing register from KAIT Tz. 55 is kept in the business unit, and the new asset inventory only covers IT systems.	Spreadsheets and macros that, for example, check unit prices are not classified (Article 8(1)) and are not in any recovery plan.	Take the end-user computing register into the inventory and assign each application to a function.

Example, transition plan and gaps are our professional assessment based on the wording of DORA, the KAGB, the KAMaRisk and BaFin’s publications. The assessment is general information and must be checked for your company in the individual case.

How we help

For KVGs, we start with the DORA gap analysis for the full framework. It shows where KAIT documents, KAMaRisk and DORA still diverge, and ends with an action plan. We flag borderline cases, such as whether a contract is outsourcing under Section 36 KAGB, for your legal counsel. If you want to rework your documentation straight away, see scope and price in our Transition from KAIT package.

Frequently asked questions

Does the KAIT still apply?+

No. BaFin repealed the KAIT at the end of 16 January 2025, and there is no transition period. Since 17 January 2025, DORA under the full framework and Delegated Regulation (EU) 2024/1774 apply to licensed KVGs, and the KAMaRisk continue to apply in their 2017 version.

Does DORA apply to registered KVGs under Section 44 KAGB?+

The KAIT did not apply to them, it only covered KVGs licensed under Section 20(1) KAGB (KAIT, preliminary remarks, Tz. 4). For DORA, this does not matter: DORA excludes small AIF managers under Article 3(2) of the AIFM Directive (Article 2(3)(a)). Whether a registered KVG falls under this follows from the wording of DORA and must be justified in the individual case.

Does the KVG’s statutory auditor audit compliance with DORA?+

Yes. Under Section 38(3) KAGB, the statutory auditor of an external KVG determines whether it has met the requirements of Articles 5 to 14, 17 to 19, 23 to 25, 28 to 30 and 45(3) DORA, also in conjunction with the delegated regulations under Articles 15, 20, 28 and 30. The transition plan above helps to present the documents in the DORA structure. How the audit works is explained on the page DORA audits.

Do KVGs have to report ICT-related incidents under DORA?+

Yes. The obligation to report major ICT-related incidents under Article 19 DORA has applied to licensed KVGs since 17 January 2025, and reports go to BaFin. How incidents are classified and which deadlines apply is explained on the page Incident reporting.

Sources

Regulation (EU) 2022/2554 (DORA), Articles 2, 3, 4, 5, 6, 8, 11, 12, 16, 28 to 30, German version (retrieved 2026-11-06)
Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management), Title II, German version (retrieved 2026-11-06)
BaFin: Circular 11/2019 (WA) KAIT as amended on 1 October 2019 (repealed, archived copy of the BaFin PDF of 26 June 2024), in German (retrieved 2026-11-06)
BaFin: news of 9 January 2025 on changes to IT requirements under DORA (repeal of KAIT, VAIT, ZAIT), in German (retrieved 2026-11-06)
BaFin: information letter of 19 December 2024 on the repeal of the supervisory requirements for IT, in German (retrieved 2026-11-06)
BaFin: supervisory notice of 8 July 2024 (as of June 2024) on implementing DORA in ICT risk management and ICT third-party risk management, foreword and sections II.1 to II.8, in German (retrieved 2026-11-06)
BaFin: supervisory notice of 21 August 2025 on the simplified ICT risk management framework (Article 16 DORA), foreword, in German (retrieved 2026-11-06)
BaFin: Circular 01/2017 (WA) KAMaRisk as amended on 10 January 2017, sections 4.1, 8.1, 8.2 and 10, in German (retrieved 2026-11-06)
BaFin: news of 12 June 2026 on the KAMaRisk consultation, in German (retrieved 2026-11-06)
BaFin: consultation 06/2026, KAMaRisk overview of changes and consultation version (draft of 12 June 2026), in German (retrieved 2026-11-06)
German Capital Investment Code (KAGB), Section 28(1) no. 5 (unofficial version, in German) (retrieved 2026-11-06)
German Capital Investment Code (KAGB), Section 36(1) and (2) (unofficial version, in German) (retrieved 2026-11-06)
German Capital Investment Code (KAGB), Section 38(3) (unofficial version, in German) (retrieved 2026-11-06)

This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).

From KAIT to DORA: what now applies to fund management companies