{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":32,"total":32,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/13","url":"https://www.headlesslaw.com/dora/articles/13","title":"Article 13 — Learning and evolving","work_id":"dora","date_state":"past","as_of":"2025-01-17","relations_url":"https://www.headlesslaw.com/dora/articles/13/relations"},"as_of":"2025-01-17","counts":{"uses_term:out":24,"refers_to:out":6,"refers_to:in":2},"relations":[{"edge_id":"33df6ad915a905254abb","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incidents","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.4"}},{"edge_id":"4d40f50c7d7291f72bc4","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(8)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.4"}},{"edge_id":"680df166bd02e1f9cccd","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.4"}},{"edge_id":"8bf3907b88a47427c70d","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"cyber-attacks","dst_raw":"eu.dora.definition.cyber-attack","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/14","url":"/definitions/dora/cyber-attack","title":"Definitions","key":"3(14)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.4"}},{"edge_id":"a5459a8f505be213845c","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.4"}},{"edge_id":"e1c95059dcb7335135bc","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.4"}},{"edge_id":"31a983c154c6d7b199fd","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.7"}},{"edge_id":"717c036e1a5cbe64e89d","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"microenterprises","dst_raw":"eu.dora.definition.microenterprise","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/60","url":"/definitions/dora/microenterprise","title":"Definitions","key":"3(60)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.7"}},{"edge_id":"e41f65931fc6645c3391","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"cyber-attacks","dst_raw":"eu.dora.definition.cyber-attack","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/14","url":"/definitions/dora/cyber-attack","title":"Definitions","key":"3(14)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.7"}},{"edge_id":"f9172d784cea26ab7e18","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.7"}},{"edge_id":"27261d6bf71e13a73c5f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"management body","dst_raw":"eu.dora.definition.management-body","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/30","url":"/definitions/dora/management-body","title":"Definitions","key":"3(30)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.5"}},{"edge_id":"22839648b5936d9b3af6","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incidents","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.1"}},{"edge_id":"27b7f8036eebe65ecceb","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"vulnerabilities","dst_raw":"eu.dora.definition.vulnerability","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/16","url":"/definitions/dora/vulnerability","title":"Definitions","key":"3(16)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.1"}},{"edge_id":"89ddea9cfbe1050b9f3b","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"cyber threats","dst_raw":"eu.dora.definition.cyber-threat","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/12","url":"/definitions/dora/cyber-threat","title":"Definitions","key":"3(12)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.1"}},{"edge_id":"d1fa87e00143b90bf131","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"cyber-attacks","dst_raw":"eu.dora.definition.cyber-attack","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/14","url":"/definitions/dora/cyber-attack","title":"Definitions","key":"3(14)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.1"}},{"edge_id":"ee5d03f96d4063b26c16","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.1"}},{"edge_id":"44ce65bec4e81bf1af17","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.6"}},{"edge_id":"55f44c6b537fdfd16f5c","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 30(2)","dst_raw":"eu.dora.article.30","other":{"work_id":"dora","level":"L1","locator":"dora/art/30","url":"/dora/articles/30","title":"Key contractual provisions","key":"30","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.6"}},{"edge_id":"c561777ca3f5ca6a44a1","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.6"}},{"edge_id":"3a7cee9c998951d2ed98","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incident","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.2"}},{"edge_id":"4325150802961a1e1020","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"major ICT-related incident","dst_raw":"eu.dora.definition.major-ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/10","url":"/definitions/dora/major-ict-related-incident","title":"Definitions","key":"3(10)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.2"}},{"edge_id":"75694010f694aff04865","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/11","url":"/dora/articles/11","title":"Response and recovery","key":"11","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.2"}},{"edge_id":"02ff8d9a880302150da0","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incidents","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.2.point.a"}},{"edge_id":"1f0cfd4f89c44d228e09","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incidents","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"2544da410887aecc81c0","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 26","dst_raw":"eu.dora.article.26","other":{"work_id":"dora","level":"L1","locator":"dora/art/26","url":"/dora/articles/26","title":"Advanced testing of ICT tools, systems and processes based on TLPT","key":"26","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"25a25425d3e353db9161","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"3589e179fbbfe609f61b","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(1)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"4c25c67dc62b0a106240","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"f172abbd8f9f9d5d1ad5","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"cyber-attacks","dst_raw":"eu.dora.definition.cyber-attack","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/14","url":"/definitions/dora/cyber-attack","title":"Definitions","key":"3(14)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"f39c1675d20e17f6bf89","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 27","dst_raw":"eu.dora.article.27","other":{"work_id":"dora","level":"L1","locator":"dora/art/27","url":"/dora/articles/27","title":"Requirements for testers for the carrying out of TLPT","key":"27","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.3"}},{"edge_id":"be18ca67050d1b6665fc","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 13(6)","dst_raw":"eu.dora.article.13","other":{"work_id":"dora","level":"L1","locator":"dora/art/30/para/2/pt/i","url":"/dora/articles/30#p-2-i","title":"Key contractual provisions","key":"30(2)(i)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.30","source_block_id":"eu.dora.article.30.paragraph.2.point.i"}},{"edge_id":"f1005a63b66a07b5c2ff","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 13(6)","dst_raw":"eu.dora.article.13","other":{"work_id":"dora","level":"L1","locator":"dora/art/5/para/2/pt/g","url":"/dora/articles/5#p-2-g","title":"Governance and organisation","key":"5(2)(g)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.g"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}