EU DORA compliance,in one platform.
RegTech platform purpose-built for the Digital Operational Resilience Act (2022/2554). ICT risk framework, NCA incident reporting, third-party risk management and WORM evidence vault — for Benelux financial institutions.
The EU Digital Operational Resilience Act (DORA, Regulation 2022/2554) entered into force in January 2025. Payment institutions, investment firms, payment consultants, insurance intermediaries and a broad financial ecosystem now face mandatory ICT risk management, incident reporting (NCA), third-party risk management and resilience testing requirements.
Existing GRC tools (ServiceNow, Vanta, Formalize) don't support DORA-specific reporting. Mid-market institutions (94% of which failed the 2025 dry-run) are looking for a ready solution. Alnera DORA sits exactly in this window: vendor feed → incident classification → automated NCA reporting pipeline, all in one product.
Alnera's .NET 9 + Next.js infrastructure meets SOC2, GDPR and EU data sovereignty expectations. Hash-chained immutable audit ledger and WORM evidence vault provide reliable evidence during regulator scrutiny.
5 core modules, one pipeline
End-to-end solution addressing DORA's five key obligations — ICT risk, incident, TPRM, evidence and dashboard.
ICT Risk Framework + Asset Inventory
Asset inventory, risk matrix and DORA Pillar I-V control library (COBIT 2019 mapped, 19-control seed). Full visibility of your enterprise ICT environment — from one place.
Incident Management + NCA Reporting
3-stage incident notification (72h / intermediate / final), XBRL/XML + DNB/AFM Excel export. Classify serious incidents instantly; NCA documents prepared automatically.
Third Party Risk + Register of Information
Vendor inventory, contract management, n-tier subcontractor chain, RoI assembly. DORA's toughest obligation — automated.
Evidence Management
WORM document vault (SHA-256, MinIO), control-evidence linking, expiration tracking. Zero Excel when the auditor arrives — just a hash-verified package.
Compliance Readiness Score + Dashboard
Single-number compliance score, Pillar heatmap, gap analysis. Cockpit that shows the executive at a glance where you stand — you, the auditor, the board.
3 AI features — automation depth
Claude and GPT-4 powered AI engine moves DORA processes from human speed to machine speed.
Business Impact Analysis
Automated BIA computation for critical business functions. Propagates MTPD, RTO, RPO values across the dependency chain.
Scenario Management
Pre-configured scenario library for resilience testing. Tabletop exercises and threat-led penetration testing (TLPT) support.
Regulatory Change Tracker
AI agent that monitors EU DORA interpretations and technical standards (RTS/ITS), mapping impact to your control library.
Get to know the product in 6 screens
Frequently Asked Questions
Which institutions does DORA cover?
A broad financial ecosystem, including EU payment institutions, investment firms, payment consultants, insurance intermediaries and credit institutions. Detailed through Regulatory Technical Standards (RTS) tied to Regulation 2022/2554.
What is the 72-hour NCA notification?
An initial notification must reach the local competent authority (NCA) within 72 hours of detecting a serious ICT incident, followed by intermediate and final reports. Alnera DORA prepares all three stages automatically.
Where is Alnera DORA hosted?
Azure NL region for EU data residency compliance. Can be deployed in your own Azure subscription; an on-premise installation option is also available.
How does it differ from Alnera RegTech?
Alnera RegTech targets SPK VII-128.10 / III-62.2 (Türkiye); Alnera DORA targets the EU DORA regulation (Benelux + Europe). Two distinct regulatory verticals within the same ecosystem.
Who can join the pilot?
We're planning a pilot in Q3 2026 with 2 payment institutions and 1 regional bank. If interested, reach out at info@alnera.nl.
Don't defer DORA compliance
Many institutions failed the 2025 dry-run. Prepare now — try the live demo or schedule a call.