{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":25,"total":25,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/5","url":"https://www.headlesslaw.com/dora/articles/5","title":"Article 5 — Governance and organisation","work_id":"dora","date_state":"past","as_of":"2023-01-16","relations_url":"https://www.headlesslaw.com/dora/articles/5/relations"},"as_of":"2023-01-16","counts":{"refers_to:out":5,"uses_term:out":20},"relations":[{"edge_id":"a514e242c497d9d69afb","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(1)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/11","url":"/dora/articles/11","title":"Response and recovery","key":"11","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.e"}},{"edge_id":"62fe101fb914801e29e6","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT services","dst_raw":"eu.dora.definition.ict-services","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/21","url":"/definitions/dora/ict-services","title":"Definitions","key":"3(21)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.h"}},{"edge_id":"b55a6d33d36fd86218a5","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.h"}},{"edge_id":"3988ff57b61b8da7dbd6","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.i.subpoint.iii"}},{"edge_id":"f1c9084d522013072b45","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"major ICT-related incidents","dst_raw":"eu.dora.definition.major-ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/10","url":"/definitions/dora/major-ict-related-incident","title":"Definitions","key":"3(10)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.i.subpoint.iii"}},{"edge_id":"47e1c07d12f815fe0334","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.a"}},{"edge_id":"48972c3f5c7db56e363f","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(8)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.d"}},{"edge_id":"64d8a7779ade7a10ef4a","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.d"}},{"edge_id":"fb0bc8dc6af96660b6de","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.d"}},{"edge_id":"290c84761d03fa502183","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT services","dst_raw":"eu.dora.definition.ict-services","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/21","url":"/definitions/dora/ict-services","title":"Definitions","key":"3(21)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.3"}},{"edge_id":"3e2656afe5482c2bdee8","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.3"}},{"edge_id":"4a299343560596c1fad1","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"microenterprises","dst_raw":"eu.dora.definition.microenterprise","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/60","url":"/definitions/dora/microenterprise","title":"Definitions","key":"3(60)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.3"}},{"edge_id":"249f170eba49b8024500","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.4"}},{"edge_id":"a35b89ae7d2271ff6350","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"management body","dst_raw":"eu.dora.definition.management-body","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/30","url":"/definitions/dora/management-body","title":"Definitions","key":"3(30)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.4"}},{"edge_id":"21ca5d64305dc7a3e47f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.i.subpoint.ii"}},{"edge_id":"025ed10c9a147b345ccf","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.1"}},{"edge_id":"ad56a6ff7e6edf61afe1","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(4)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.1"}},{"edge_id":"ed37668930e27f3f1263","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.1"}},{"edge_id":"65f27831d46901e522c7","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.g"}},{"edge_id":"f1005a63b66a07b5c2ff","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 13(6)","dst_raw":"eu.dora.article.13","other":{"work_id":"dora","level":"L1","locator":"dora/art/13","url":"/dora/articles/13","title":"Learning and evolving","key":"13","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.g"}},{"edge_id":"dbe900f381cc0fd0c9cf","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT services","dst_raw":"eu.dora.definition.ict-services","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/21","url":"/definitions/dora/ict-services","title":"Definitions","key":"3(21)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.i.subpoint.i"}},{"edge_id":"f3f35975224b5fe626e1","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.i.subpoint.i"}},{"edge_id":"47dad20162d67c4f77e8","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(1)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2"}},{"edge_id":"6372cf4f5551fc09b00d","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2"}},{"edge_id":"6589b5554f91f98d6dbb","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"management body","dst_raw":"eu.dora.definition.management-body","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/30","url":"/definitions/dora/management-body","title":"Definitions","key":"3(30)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}