AnnexOps Compliance
DORA Compliance Automation: ICT Resilience on the Record
AnnexOps derives the DORA regime that likely applies to you from facts you record: full framework, simplified under Article 16, or out of scope. It then tracks 46 requirements across ICT risk, incidents, resilience testing and third-party risk. Your register of information builds on the supplier register you already keep, and major-incident clocks are staged as modelled from RTS 2025/301. Versioned rules. Evidence you can verify.
Regime derived, not guessed · Register of information, CSV export · Incident clocks staged, RTS 2025/301
How DORA automation works
Derived from facts, verifiable over time
Rules as data
Regime derivation and the major-incident clocks are versioned rules that cite the article, from Article 16 to RTS 2025/301. A second reviewer re-running the check gets the same answer. No language model sits in the verdict path.
Derivation, not judgment
The platform derives what DORA asks from facts you record: entity type, Article 16 categories, critical or important functions, ICT arrangements. Whether an incident is major under RTS 2024/1772 stays your recorded judgment, with the criteria beside it.
Agents draft, you sign
Agent suggestions, such as a draft policy or a proposed control mapping, land in Approvals. Nothing changes a canonical record until a named person signs it, and every decision becomes an audit event that supports your management body’s oversight of the framework under Article 5(2).
Evidence you can verify
Connectors read configuration metadata only. Each item lands append-only on a hash chain, so an Article 6(6) internal auditor or a supervisor can detect tampering after the fact. Controls operating over time, not a screenshot taken the week before.
Core capabilities
Everything your DORA programme needs, on record
46 requirements, 82 shared controls
46 requirements across ICT risk management, incidents, resilience testing and third-party risk, linked to 82 of the 211 shared controls. The same controls carry your ISO 27001, SOC 2 and NIS2 evidence, so the locked DORA card shows how much you already cover before you add it. Assessed requirement coverage is indicative, with every gap listed.
Third-party register of information
Article 28(3) requires a register of information covering all ICT contractual arrangements, distinguishing those that support critical or important functions, reported on yearly and available to your authority on request. AnnexOps builds it on the supplier register you already keep and exports it to CSV. You submit it to your authority in the format it prescribes, xBRL-CSV under the ESAs’ technical package.
Read-only connectors, continuous checks
Continuum connects read-only to GitHub, Amazon Web Services and Microsoft Entra ID, collects configuration metadata only and grades 743 automated checks against the frameworks you hold. The controls behind Article 9 protection and prevention are evidenced as they operate, append-only and hash-chained, not from screenshots.
Resilience testing and ICT risk, on record
Your digital operational resilience testing programme under Articles 24 to 27 is kept on the record, with TLPT tracked only where your authority designates you. Running the tests is yours. The ICT risk register, assets and suppliers behind the Article 6 framework are the registers your ISMS already keeps, recorded once.
Audit Room for your auditor
DORA has no certificate. Under the full framework what you face is Article 6(6) internal audit (entities other than microenterprises), management-body review under Article 5 and supervisory requests. Under Article 16 the simplified framework is reviewed periodically and reported to your authority on request. The Audit Room gives an auditor read-only access scoped to DORA, ending on a date you set, with point-in-time evidence packages built from your records.
Major-incident reporting on chained clocks
Classify an incident as major against the RTS 2024/1772 criteria and AnnexOps stages the Article 19 clocks. Initial notification within 4 hours of classification, no later than 24 hours after awareness; intermediate within 72 hours of that notification; final within one month of the latest intermediate report. Modelled from RTS 2025/301. You confirm and submit.
Integrations
Works With Your Existing Stack
- GitHub
- Amazon Web Services
- Microsoft Entra ID
- Jira
- SharePoint
- GitLab (coming soon)
- Microsoft Azure (coming soon)
- Google Cloud (coming soon)
- Okta (coming soon)
- Google Workspace (coming soon)
- Microsoft Intune (coming soon)
- Workday (coming soon)
FAQs
Some Frequently Asked Questions and Their Answers
Does DORA have a certificate, and who checks our compliance?
No. DORA has no certification audit. Under the full framework your management body approves and oversees the ICT risk management framework under Article 5. Internal auditors review it under Article 6(6), for entities other than microenterprises. Under the simplified Article 16 framework the review is periodic and reported to your authority on request. Your national competent authority supervises you and receives your register and incident reports. AnnexOps is none of these. It organises evidence, stages the clocks and gives your auditor a read-only Audit Room. You submit to the authority. The conclusions are theirs.
How does AnnexOps decide whether the full framework or the simplified Article 16 regime applies?
From facts you record about the entity: its type under Article 2(1), whether it falls in an Article 16(1) category, and whether an Article 2(3) exclusion applies. The Article 16(1) categories are small and non-interconnected investment firms, exempted payment and e-money institutions, small occupational pension funds (IORPs) and the other entities listed there. A versioned rule derives full framework, simplified or out of scope and cites the article it relied on. Re-run it next year: same facts, same answer. The result is indicative. Your counsel decides.
Does AnnexOps file the register of information or incident reports with our authority?
No. AnnexOps builds the Article 28(3) register of information on your supplier register and exports it to CSV. The templates come from Implementing Regulation (EU) 2024/2956 and the xBRL-CSV submission is yours to produce. Major-incident clocks are staged as modelled from RTS 2025/301 and every step is recorded, but your team confirms the classification and sends the Implementing Regulation (EU) 2025/302 forms. Oversight of critical ICT third-party providers (Articles 31 to 44) and running TLPT are out of scope.
Who wrote the DORA requirement content, and has it been reviewed?
AnnexOps authored the 46 DORA requirements and the mapping to 82 shared controls, working from Regulation (EU) 2022/2554 and the delegated and implementing acts listed in our sources. Specialist review is in progress and the product labels the content accordingly. The EU AI Act and GDPR content has already been through counsel review. Every rule is versioned and cites its article, so a reviewer, yours or ours, can check the reading against the text and the change history.
News & Articles
The EU AI Act Explained: A Practical Guide for Companies Building or Using AI
Artificial intelligence is rapidly transforming how organizations operate. From predictive analytics and fraud detection to recruitment automation and…
Read More The EU AI Act Explained: A Practical Guide for Companies Building or Using AI
High-Risk AI Systems Under the EU AI Act: What Companies Must Do to Stay Compliant
Artificial intelligence has rapidly become an essential part of modern business operations. From financial risk analysis to automated…
Read More High-Risk AI Systems Under the EU AI Act: What Companies Must Do to Stay Compliant
AI Governance Platforms: Why Companies Need Infrastructure to Comply With the EU AI Act
Artificial intelligence is becoming a foundational technology across industries. Organizations are using AI to automate decisions, optimize operations,…
Read More AI Governance Platforms: Why Companies Need Infrastructure to Comply With the EU AI Act