How do DORA and NIS2 relate?

For financial entities that are also essential or important entities under NIS2, DORA is a sector-specific Union legal act for the purposes of Article 4 of NIS2 (DORA Article 1(2)). Under NIS2 recital 28 and the Commission guidelines (C/2023/6068, published in the Official Journal on 18 September 2023), Member States should not apply NIS2's cybersecurity risk-management and reporting obligations or its supervision and enforcement provisions to those financial entities; DORA applies instead. NIS2's national cyber crisis management frameworks (Article 9) and EU-CyCLONe (Article 16) continue to apply. Group companies or ICT suppliers that are not DORA financial entities may still fall under NIS2 in their own right.

Can DORA regulators fine a Taiwanese ICT provider directly?

Generally not. A provider that has not been designated as a critical ICT third-party service provider has no direct DORA obligations; the requirements reach it through its customers' contracts and registers of information, and penalties for financial entities are set by each Member State in national law under Article 50. Only a designated critical provider can face periodic penalty payments from its Lead Overseer under Article 35: imposed daily, for at most six months, of up to 1% of its average daily worldwide turnover in the preceding business year. The first list of 19 critical providers, published on 18 November 2025, includes no Taiwanese company.

Is the DORA fine 2% of worldwide annual turnover?

No. DORA sets no turnover-based fine for financial entities; penalties are set by each Member State in national law and must be effective, proportionate and dissuasive (Article 50). The often-quoted 2% of worldwide annual turnover is the NIS2 Article 34 figure for essential entities, which under NIS2 Article 4 does not apply to DORA financial entities.

How long does DORA consulting take?

It depends on your position and existing systems; the experience listed on Winners Consulting's service page is usually 2 to 3 months to prepare for an ICT supplier's contractual obligations, and 6 to 9 months for a financial institution to build a complete DORA framework, shorter where an ISO 27001 or business continuity foundation exists.

How to choose a DORA consultant in Taiwan: eight criteria

Direct answer: the first question to ask a DORA consultant is "am I a financial entity directly regulated by DORA, or an ICT third-party service provider to financial entities?" DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025) directly regulates EU financial entities such as banks, insurers, investment firms, payment institutions and crypto-asset service providers. Taiwanese software, cloud and security service providers that serve these institutions are usually ICT third-party service providers: the obligations reach you mainly through the contract terms that your customers must include under Article 30 (for example, a description of the services, the locations where services are provided and data is processed, assistance with ICT incidents, cooperation with the competent authorities and termination rights; for services supporting critical or important functions there are more, such as service levels, business contingency plans and testing, audit rights and exit strategies), and your customers must also record your services in their register of information (templates in Implementing Regulation (EU) 2024/2956; providers outside the EU are identified by LEI). Next, check whether the consultant can build these requirements, together with the major incident reporting and resilience testing that your customers ask you to support, on your existing ISO 27001 and business continuity systems. The reporting clocks must be counted correctly: under Delegated Regulation (EU) 2025/301, the initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; the intermediate report within 72 hours of the initial notification; and the final report within one month of the latest intermediate report.

Three common positions for Taiwanese companies

Position	How to tell	What to do
EU financial entity (including subsidiaries established in the EU)	Listed as a financial entity in Article 2(1)	ICT risk management framework, major incident classification and reporting, resilience testing, ICT third-party risk management and the register of information
ICT third-party service provider to financial entities	Provides ICT services to those financial entities	Support the Article 30 contract terms, provide the information needed for the register, support incident handling and testing, prepare exit arrangements
Designated critical ICT third-party service provider	Designated by the European Supervisory Authorities under Article 31; the first list of 19 providers, published on 18 November 2025, includes no Taiwanese company	Direct oversight by a Lead Overseer; providers outside the EU must establish a subsidiary in the EU within 12 months of designation for financial entities to keep using their services

Eight criteria

Criterion	Question you can ask any consultant
Determining our position	Am I a financial entity, an ICT third-party service provider, or a possible critical ICT third-party service provider? Under which article?
Contract terms	What obligation does each Article 30 term our customers ask for create? What is added for critical or important functions?
Register of information	What information do our customers' registers of information need from us?
Major incident reporting	How is an incident classified as major under Delegated Regulation (EU) 2024/1772? Who handles the initial notification (within 4 hours of classification as major, and no later than 24 hours after awareness), the intermediate report (within 72 hours) and the final report (within one month), and what do we need to provide?
Resilience testing	Which systems does annual testing cover? Does threat-led penetration testing (TLPT) apply, and how do we support it?
Exit strategy	When a service ends or changes provider, how are data and services transferred, and how long is the transition?
Integration with existing systems	Can DORA gaps be added on top of our existing ISO 27001 and business continuity systems instead of building a separate set?
Who leads, and is work subcontracted	Who actually runs the engagement, with what qualifications? Will any of it be subcontracted?

When you may not need a consultant

If you do not serve EU financial entities, or your customers only ask you to fill in a security questionnaire without asking you to sign DORA contract terms, answering with the processes and records of your existing ISO 27001 system is usually enough. When you need a legal opinion on contractual liability or jurisdiction, consult a lawyer.

How Winners Consulting addresses these criteria

What follows is Winners Consulting's own description. Test us with the questions above, just as you test other consultants.

Determining your position: confirm whether you are a type of financial entity covered by DORA or an ICT supplier to financial entities, and assess the scope of direct and contractual obligations
ICT risk management framework: under DORA Chapter II, set up ICT asset inventory, risk identification and assessment, protection, detection, and response and recovery procedures
Incident reporting: design severity criteria and a reporting process for major incidents
ICT third-party risk management: set up supplier risk assessment, required contract terms (audit rights, data portability, exit strategy) and maintenance of the register of information
Resilience testing: plan the annual testing programme, assess whether TLPT applies, and feed test results back into risk management
Integration with existing systems: where an ISO 27001 or business continuity foundation exists, reuse existing documents and controls
Who leads: vice-president and director-level consultants run the whole engagement; nothing is subcontracted

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.