{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":26,"total":26,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/16","url":"https://www.headlesslaw.com/dora/articles/16","title":"Article 16 — Simplified ICT risk management framework","work_id":"dora","date_state":"past","as_of":"2022-12-27","relations_url":"https://www.headlesslaw.com/dora/articles/16/relations"},"as_of":"2022-12-27","counts":{"refers_to:out":1,"uses_term:out":20,"refers_to:in":5},"relations":[{"edge_id":"2bf6cebeac9e107ffd5a","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 2(4)","dst_raw":"eu.dora.article.2","other":{"work_id":"dora","level":"L1","locator":"dora/art/2","url":"/dora/articles/2","title":"Scope","key":"2","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1"}},{"edge_id":"3b0c339072a1a9f18f85","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"small and non-interconnected investment firms","dst_raw":"eu.dora.definition.small-and-non-interconnected-investment-firm","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/34","url":"/definitions/dora/small-and-non-interconnected-investment-firm","title":"Definitions","key":"3(34)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1"}},{"edge_id":"71b6f25bdbf6e428309c","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"payment institutions","dst_raw":"eu.dora.definition.payment-institution","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/35","url":"/definitions/dora/payment-institution","title":"Definitions","key":"3(35)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1"}},{"edge_id":"dcb4e3794aab4a3ab9be","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"electronic money institutions","dst_raw":"eu.dora.definition.electronic-money-institution","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/38","url":"/definitions/dora/electronic-money-institution","title":"Definitions","key":"3(38)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1"}},{"edge_id":"ef839708b59975d2e7b4","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.3.point.e"}},{"edge_id":"348f2b36e1d8676ec911","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important function","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.3.point.d"}},{"edge_id":"3273f6b14275add6017e","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.f"}},{"edge_id":"6ccdbc7f903bbe2bbb56","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.d"}},{"edge_id":"9873ef394995483351e7","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incidents","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.d"}},{"edge_id":"e17da3a7262e27ca8ed0","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"network and information systems","dst_raw":"eu.dora.definition.network-and-information-system","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/2","url":"/definitions/dora/network-and-information-system","title":"Definitions","key":"3(2)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.d"}},{"edge_id":"80d6610c459ecdd5aa75","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.e"}},{"edge_id":"6994e4e11ac0374fe95e","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.h"}},{"edge_id":"f3ef5f1a04216c52fa9a","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.h"}},{"edge_id":"042542f55cb0d243fb07","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"network and information systems","dst_raw":"eu.dora.definition.network-and-information-system","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/2","url":"/definitions/dora/network-and-information-system","title":"Definitions","key":"3(2)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.c"}},{"edge_id":"df1227c11cfd0468efc5","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.c"}},{"edge_id":"fbe60f7ca58277363ac1","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.3.point.b"}},{"edge_id":"1645b37ac49cde308e63","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Joint Committee","dst_raw":"eu.dora.definition.joint-committee","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/62","url":"/definitions/dora/joint-committee","title":"Definitions","key":"3(62)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.3"}},{"edge_id":"a34abfe45b50d3a47708","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.1.point.a"}},{"edge_id":"18bb5a8118138cfae380","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.3.point.a"}},{"edge_id":"14854e6557d6231489c5","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.2"}},{"edge_id":"519a209397ef8b4caae2","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"major ICT-related incidents","dst_raw":"eu.dora.definition.major-ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/10","url":"/definitions/dora/major-ict-related-incident","title":"Definitions","key":"3(10)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.16","source_block_id":"eu.dora.article.16.paragraph.2"}},{"edge_id":"10f8fe518f91b9c24165","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16(2)","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/4/para/3","url":"/dora/articles/4#p-3","title":"Proportionality principle","key":"4(3)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.4","source_block_id":"eu.dora.article.4.paragraph.3"}},{"edge_id":"2fa7f40de42990c231e4","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16(1)","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/28/para/2","url":"/dora/articles/28#p-2","title":"General principles","key":"28(2)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.28","source_block_id":"eu.dora.article.28.paragraph.2"}},{"edge_id":"56bc1556784534fa0a9c","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16(1)","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/26/para/1","url":"/dora/articles/26#p-1","title":"Advanced testing of ICT tools, systems and processes based on TLPT","key":"26(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.26","source_block_id":"eu.dora.article.26.paragraph.1"}},{"edge_id":"85982abeaa7a844394e5","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/11/para/11","url":"/dora/articles/11#p-11","title":"Response and recovery","key":"11(11)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.11"}},{"edge_id":"eede77ca1e9ce2520681","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/32/para/7","url":"/dora/articles/32#p-7","title":"Structure of the Oversight Framework","key":"32(7)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.7"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}