Transition to DORA · full framework
Transition from KAIT to DORA: move your documentation, align it with KAMaRisk
German capital management companies (Kapitalverwaltungsgesellschaften, KVG) have applied the DORA full framework since 17 January 2025. BaFin repealed KAIT, its former IT circular for these companies, with effect from the end of 16 January 2025. Many policies, roles and contingency documents still follow KAIT. With our “Transition from KAIT” package we move this documentation to DORA and RTS 2024/1774, align it with KAMaRisk, rehearse recovery and reporting and hand over the evidence. From €29,400 net plus VAT for the base scope described below.
Why a transition if DORA already applies?
This service covers the full framework: capital management companies have applied Articles 5-15 DORA since 17 January 2025, with no transitional period. The simplified framework of Article 16 is not available to former KAIT addressees. Registered small AIF managers under Article 3(2) of the AIFM Directive are exempt from DORA, so the package is not meant for them.
Many companies have had their register of information and the main DORA policies in place since early 2025. Underneath, however, there is often documentation still built along KAIT lines: policies in the old structure, an information security officer without a clear line to the ICT risk control function, an IT contingency concept without a business impact analysis under DORA, an outsourcing list that has never been reconciled with the register. The package is a clean-up of this existing documentation. We move it into the DORA framework, keep what works and align it with KAMaRisk, BaFin’s minimum requirements for risk management of capital management companies, which continue to apply. A German explainer page on KAIT, DORA and KAMaRisk is in preparation.
What does the “Transition from KAIT” package include?
Eight building blocks that build on each other. Article references without a suffix refer to DORA, “RTS” to Commission Delegated Regulation (EU) 2024/1774, Title II.
What do we already have?
Inventory of KAIT and KAMaRisk documents
We map every existing document to the relevant DORA or RTS provision and decide with you: keep, rework or merge. BaFin’s comparison of 8 July 2024 covers BAIT and VAIT. For KAIT documents we therefore do the mapping ourselves and use that comparison as a guide.
KAIT and DORA (German)Is the framework based on DORA?
Framework, DOR strategy and policies
ICT risk management framework under Article 6, digital operational resilience strategy under Article 6(8) as a draft or a review of the existing one, policies and procedures structured along RTS Title II. Where possible we rework your own texts.
ICT risk management in the full framework (German)Who is responsible?
Roles and ICT risk control function
Duties of the management body (Article 5(2)), ICT risk control function with an appropriate level of independence (Article 6(4)), monitoring of ICT contracts (Article 5(3)). We clarify with you how the information security officer, risk controlling and the control function relate, and prepare the management resolution.
What applies alongside DORA?
Alignment with KAMaRisk
The applicable version is KAMaRisk, circular 01/2017 (WA). On 12 June 2026 BaFin published a draft for consultation 06/2026 which, according to its announcement, removes duplications with DORA among other things. As of 6 November 2026 we were not aware of a final version. We plan against the version in force and mark the points the draft would affect.
KAIT and DORA (German)What is critical?
Function list, BIA and recovery objectives
Critical or important functions under Article 3(22) with reasons and supporting systems and providers, business impact analysis under Article 11(5), recovery objectives per function under Article 12(6), ICT response and recovery plans and a crisis management function (Article 11(7)).
Classifying functions (German)Outsourcing or ICT service?
Outsourcing and ICT third parties
Articles 28-30 cover every contractual arrangement for ICT services, and according to BaFin the sector-specific outsourcing rules apply in parallel. We reconcile the outsourcing list with the register of information, tag each arrangement and compare up to ten providers with the contract terms of Article 30(2) and (3) on the subject matter.
Managing ICT third parties (German)Does it work when it matters?
Recovery and reporting exercise
A recovery exercise for one critical or important function as part of the annual tests under Article 11(6), and a reporting exercise as a tabletop up to the initial notification, within 4 hours of classification as major and no later than 24 hours after becoming aware. We do not plan on the weekend and holiday relief, because it does not apply to every financial entity. Deficiencies go to management with a report.
DORA incident reporting (German)Where is the evidence?
Evidence matrix and annual calendar
Every requirement of the full framework with evidence, owner and storage location. Plus a calendar of recurring duties, for example the review of the framework at least once a year (Article 6(5)), annual tests of the plans (Article 11(6)) and of systems supporting critical or important functions (Article 24(6)), assessment of legacy systems (Article 8(7)), training of the management body (Article 5(4)) and the annual submission of the register of information.
What you have at the end
We hand over the results as drafts for your company to adopt and as an organised evidence file.
01
Mapping of your documentation
Every KAIT-era document with a decision (keep, rework, merge) and the relevant DORA or RTS provision.
02
Framework, DOR strategy, policies and procedures
Up to twelve documents as drafts, structured along RTS Title II, with an old-to-new map.
03
Role model with draft resolution
ICT risk control function, information security officer and monitoring of ICT contracts with tasks, boundaries and a draft resolution for management.
04
KAMaRisk alignment
Where KAMaRisk and DORA cover the same topic and which document addresses it, with a note on the points the consultation draft of 12 June 2026 would affect.
05
Function list, BIA and plans
Critical or important functions with reasons, business impact analysis, recovery time and recovery point per function, response and recovery plans.
06
Exercise records, evidence matrix, annual calendar
Record of the recovery exercise, evaluation of the reporting exercise with deficiencies and actions, reconciled provider list, evidence matrix and calendar of recurring duties.
Example: timeline at a capital management company
Fictitious example, not a client: a capital management company with around 90 employees managing retail and special funds, with fund accounting and data centre at external providers. Register of information and reporting process running since 2025, policies and contingency concept still following KAIT. Start in January 2027. Not a promise of timing: management dates and the availability of providers shift the plan.
| Period | Phase | Result | Resolution |
|---|---|---|---|
| January to February 2027 | Inventory and mapping | 47 documents mapped, draft function list and BIA, differences between outsourcing list and register recorded | none |
| March 2027 | Framework, strategy and roles | Framework, DOR strategy, role model with control function | management meeting in March |
| April to May 2027 | Policies, procedures and KAMaRisk alignment | eleven policies and procedures reworked, KAMaRisk alignment with a note on the draft, Article 30 comparison for nine providers | adoption by management |
| June 2027 | Exercises and handover | recovery exercise for fund accounting, reporting exercise, evidence matrix, annual calendar | report to management |
Example by Blackfort Technology, no commitment to dates or results.
What does the transition from KAIT cost, and where are the limits?
From €29,400 net for the base scope described below. Calculated at €1,400 net per person-day (PD), the table shows the effort per component. We price additional legal entities, documents, workshops or providers after the scoping call.
| Component | Included in the package | PD |
|---|---|---|
| Legal entities | one | - |
| Inventory and mapping | up to 60 documents | 3 |
| Framework, policies and procedures | up to 12 drafts, including a draft or review of the DOR strategy | 6 |
| Roles and governance with draft resolutions | role model with ICT risk control function (Article 6(4)) and monitoring of ICT contracts | 1.5 |
| Function list, BIA, recovery objectives, ICT providers | up to 10 providers in the function list and Article 30 comparison | 3 |
| Alignment with KAMaRisk | against the version in force, circular 01/2017 (WA), with the draft of 12 June 2026 as a note | 1.5 |
| Recovery and reporting exercise | one each: recovery of one critical or important function (planning, support and record by us, carried out by your IT or your provider), reporting exercise as a tabletop of up to 3 hours | 2 |
| Evidence matrix, annual calendar, handover | evidence matrix, annual calendar | 1.5 |
| Project management and workshops | up to 8 workshops of up to 3 hours each, 2 of them with management, by video or on site | 2.5 |
| Total | 21 | |
| Price (€1,400 per PD) | from €29,400 net plus VAT for this base scope |
Offered to businesses only (B2B). PD = person-day. We price additional legal entities, such as further companies in a group, and additional documents, workshops or providers after the scoping call and state the price in our proposal. If KAMaRisk is revised during the project, we agree the adjustment with you. A previously commissioned full framework gap analysis is credited, with details in the proposal.
How does the transition work?
Four phases. How long they take depends mainly on how quickly documents, meetings and management resolutions come together.
1
Inventory and mapping
Collect and map documents, draft the function list and BIA, put the outsourcing list and the register side by side.
2
Framework, strategy and roles
Framework and DOR strategy, role model with control function, management resolution on roles, function list and BIA.
3
Policies, procedures and KAMaRisk alignment
Rework policies and procedures, align with KAMaRisk with a note on the draft, tag providers and compare them with Article 30.
4
Exercises and handover
Recovery and reporting exercise, evaluation, evidence matrix and annual calendar, closing session with management.
The DORA duties have applied since 17 January 2025, and a project plan postpones none of them. A future version of KAMaRisk does not change these duties either, so we do not wait for it. The plan sets what comes first: usually roles, function list and BIA, because plans, exercises and provider management build on them.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Transition package, explainer page or gap analysis?
Our German page on KAIT and DORA will explain what became of KAIT and how KAMaRisk and DORA interact. It is in preparation. Until then, the duties of the full framework are on our ICT risk management page (in German). With the package we carry out the rebuild together with you and hand over the results.
The full framework gap analysis is an analysis with an action plan: it shows where you stand and leaves open who implements. If you do not know how much KAIT legacy there is in your company, start with the analysis. If you then commission the package, the gap analysis is credited, with details in the proposal. If you already know the scope, start directly with the package, which includes the inventory.
Who the package is not meant for
Registered small AIF managers under Article 3(2) of the AIFM Directive are outside DORA. BaFin points out that supervised undertakings outside DORA still have to deal appropriately with ICT and cyber risks as part of a proper business organisation. This package is too large for that. Our applicability page (in German) explains whether and under which framework DORA applies to your company.
Who is responsible for the package
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology. DORA-Readiness is a service by Blackfort Technology, Bonn, owner-managed since 2017. Our DORA experience and the engagements it comes from are described on our About us page.
What does your company contribute?
A contact person
For example the ICT risk control function, the information security officer or risk controlling, with about one day per week for coordination, documents and review of drafts.
Management
Two workshop dates and the resolutions on roles, strategy, function list and BIA. Responsibility for the framework stays with the management body (Article 5(2) DORA).
Outsourcing management and IT
The people responsible for outsourcing and contingency management in the workshops, information on systems and contracts, and IT or the provider carrying out the recovery exercise.
What is not part of the package?
To set expectations:
- No technical implementation. Your IT or your providers set up network security, logging or vulnerability management. We describe the requirement and review the evidence. Technical implementation with us is agreed separately.
- No legal advice, no contract negotiation and no legal contract review. The comparison with Article 30 DORA is on the subject matter. Whether an arrangement is outsourcing under the rules for capital management companies and how clauses are worded is a matter for your legal counsel. Building and submitting the register of information is not part of the package.
- No assumption of roles. We take on the ICT risk control function, the information security officer or internal audit only under a separate engagement.
- No commitment as to how supervisors, statutory auditors or internal audit will assess the result, and no prediction of what the final KAMaRisk will look like. No certificate.
The assessments on this page are general information on DORA, RTS 2024/1774 and KAMaRisk as of 6 November 2026. Whether and how they apply to your company has to be checked case by case.
Frequently asked questions
DORA has applied since January 2025. Are we behind if we still have KAIT documents?+
That cannot be said in general. Many companies implemented the DORA duties in 2025 and kept using KAIT-era documents, often for good reason. The package puts this documentation in order and closes the points where KAIT structure and DORA diverge. The inventory, or a gap analysis beforehand, shows where you stand.
Should we wait for the new KAMaRisk?+
We advise against it. The DORA duties apply regardless of KAMaRisk. The draft of 12 June 2026 is not law in force, and as of 6 November 2026 we were not aware of a final version. We work to the KAMaRisk in force and note where the draft would change something. That way a new version can be incorporated later with little effort.
Does the simplified framework of Article 16 apply to smaller capital management companies?+
No. According to BaFin, former KAIT addressees do not fall under Article 16. Capital management companies apply the full framework. Registered small AIF managers under Article 3(2) of the AIFM Directive are wholly exempt.
Is the gap analysis credited?+
Yes. A previously commissioned full framework gap analysis is credited against the package. Details are in the proposal.
Do we have to abolish our information security officer?+
No. The tasks remain even though DORA does not name the role. In the “Roles and ICT risk control function” block we agree with you how the information security officer and the control function relate.
Read more
- KAIT and DORA: mapping, KAMaRisk draft and transition plan
- ICT risk management under DORA: framework and DOR strategy
- DORA gap analysis: quick check, Article 16 and full framework
- Classifying critical or important functions under DORA
- ICT third-party risk under DORA: managing providers and Article 30 contracts
- DORA incident reporting: classifying and reporting ICT-related incidents
- DORA register of information: structure, mandatory fields, submission
- DORA scope: who does DORA apply to, and which framework?
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 2, 3, 5, 6, 8, 11, 12, 24, 28-30 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management, Title II) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports) (retrieved 2026-11-06)
- BaFin news of 9 January 2025 on the repeal of KAIT, VAIT and ZAIT (German) (retrieved 2026-11-06)
- BaFin supervisory notice of 8 July 2024 (as of June 2024) on implementing DORA in ICT risk management and ICT third-party risk management (PDF, German) (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA, foreword on KAIT addressees (PDF, German) (retrieved 2026-11-06)
- BaFin circular 01/2017 (WA) KAMaRisk (German) (retrieved 2026-11-06)
- BaFin news of 12 June 2026 on consultation 06/2026 on KAMaRisk (draft, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss your transition
Tell us briefly which funds you manage, how many employees you have, which documents date from the KAIT era and which providers run fund accounting and IT. In the initial call, by phone or video, we check whether the package fits. In the scoping call that follows we set scope, price and start date.