Sovereign GRC AI engine that maps controls, finds gaps, drafts assessment responses and creates risks, issues and tasks inside the 6clicks Hub & Spoke platform.
DORA (EU Digital Operational Resilience Act)
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It entered into force on 16 January 2023 and applies from 17 January 2025 to more than 20 types of EU financial entities, covering ICT risk management, ICT-related incident reporting, resilience testing, ICT third-party risk and oversight of critical ICT third-party providers.
Tag means the vendor's own pages document DORA support (requirement mapping, ICT third-party/register workflows, incident or testing evidence). It is not a DORA compliance certification of the tool or of your organisation, and DORA applies to financial entities, not to the tools.
Key facts
Official sources
Last checked 2026-10-19. Every sentence links to an official source in the dataset.
- DORA (Regulation (EU) 2022/2554) entered into force on 16 January 2023 and applies from 17 January 2025. It is accompanied by Directive (EU) 2022/2556. Source
- DORA harmonises digital operational resilience rules for more than 20 types of financial entities, 12 of them in ESMA's remit. Source
- Its main areas are ICT risk management, ICT third-party risk management (including key contractual provisions), digital operational resilience testing including advanced testing, ICT-related incident management and reporting of major incidents and significant cyber threats, information sharing, and an oversight framework for critical ICT third-party providers. Source
- ESMA maps the Level 1 text as: risk management Arts. 5–16 and 26–30, incident reporting Arts. 17–23 and the oversight framework Arts. 31–44, with Level 2 RTS/ITS such as the ITS on register-of-information templates (Art. 28(9)) and the RTS on threat-led penetration testing (Art. 26(11)). Source
- On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of designated critical ICT third-party providers (CTPPs), built from financial entities' registers of information: 19 providers. Source
From this dataset
- 17 verified listings on this page, with headquarters in 4 HQ regions and 10 countries.
- Dataset version 0.1.13, generated 2026-10-19.
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It entered into force on 16 January 2023 and applies from 17 January 2025 to more than 20 types of EU financial entities, covering ICT risk management, ICT-related incident reporting, resilience testing, ICT third-party risk and oversight of critical ICT third-party providers.
Cite as: Agent Index by Heritage Services, DORA (EU Digital Operational Resilience Act), dataset v0.1.13 (https://agentindex.heritageservices.online/frameworks/dora/)
FAQ (from this dataset)
What is listed on this framework hub?
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It entered into force on 16 January 2023 and applies from 17 January 2025 to more than 20 types of EU financial entities, covering ICT risk management, ICT-related incident reporting, resilience testing, ICT third-party risk and oversight of critical ICT third-party providers. 17 verified listings from Agent Index dataset v0.1.13.
How many listings are on this page?
17 verified listings in dataset v0.1.13 (2026-10-19).
Which listings are headquartered in India, Asia-Pacific or Australia/NZ?
1 of 17 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand: 6clicks Hailey AI (Australia).
Is this a ranking?
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
Official sources: eur-lex.europa.eu/eli/reg/2022/2554/oj · esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora · eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital · esma.europa.eu/sites/default/files/2025-11/List_of_designated_CTPPs.pdf
Who it applies to / what it covers
DORA (Regulation (EU) 2022/2554) entered into force on 16 January 2023 and applies from 17 January 2025. It harmonises digital operational resilience rules for more than 20 types of EU financial entities (12 of them in ESMA's remit). The main areas are ICT risk management, ICT third-party risk management (including key contractual provisions), digital operational resilience testing including advanced testing, ICT-related incident management and reporting of major incidents and significant cyber threats, information sharing, and an oversight framework for critical ICT third-party providers.
Listed vendors whose corporate group appears on the ESAs' CTPP list
Exact group matches to the 19 designated critical ICT third-party providers published by the ESAs on 18 November 2025. CTPP designation concerns the provider's role for EU financial entities; it is not a certification or endorsement of any listed agent. NTT DOCOMO BUSINESS is omitted (a different company from NTT DATA Inc.).
- Amazon Q Developer security scanning — CTPP entity: Amazon Web Services EMEA Sarl
- AWS Continuum for penetration testing (formerly AWS Security Agent) — CTPP entity: Amazon Web Services EMEA Sarl
- Kiro (agent platform with security integrations) — CTPP entity: Amazon Web Services EMEA Sarl
- Google Security Operations Triage and Investigation Agent — CTPP entity: Google Cloud EMEA Limited
- IBM watsonx Orchestrate (incl. watsonx Orchestrate for Government) — CTPP entity: International Business Machine Corporation
- Microsoft Entra Conditional Access Optimization Agent — CTPP entity: Microsoft Ireland Operations Limited
- Microsoft Security Copilot Phishing Triage Agent (Defender) — CTPP entity: Microsoft Ireland Operations Limited
- SAP Joule Agents and Joule Studio — CTPP entity: SAP SE
Use-case comparisons with 2+ listings tagged DORA: Contract and legal-review AI agents · Agentic pentesting AI agents · TPRM and vendor-risk AI agents · Security questionnaire AI agents
Agents tagged for DORA
17 listings. Tags indicate relevance for evaluation — not a certification that the vendor “implements” the law. DORA tags show vendor-documented DORA support (requirement mapping, ICT third-party/register workflows, incident or testing evidence), not a DORA certification of the tool or of your organisation.
On-demand penetration testing run by a fleet of AI hacker agents, paired with Hadrian Atlas for continuous external exposure management.
Generative-AI agents for financial-services regulatory compliance: a Screening Agent for horizon scanning and alerts, a Gap Analysis Agent that maps rules such as DORA, PSD3 and MiCAR against your policies, and a Reports Agent.
Team of risk-informed AI agents for each stage of the third-party risk lifecycle, covering intake checks, evidence review, issues management and executive reporting, with the customer's team in control.
EU-hosted compliance platform for European companies whose agents read documents and GitHub evidence, watch security advisories, flag gaps and propose actions, with per-agent autonomy set to Propose & Wait, Hybrid or Full.
EU-hosted compliance platform where AI agents connected to your systems draft policies, map controls across frameworks, collect evidence daily, flag control drift and draft risk treatments, with every output a draft a human must accept.
European Cyber GRC platform whose AI agent, Jerry, turns NIS2, ISO 27001 and DORA requirements into measures and tasks, assigns them to owners, follows up delays, collects and checks evidence freshness and escalates only what is blocked.
German agentic GRC/ISMS platform whose agents import and map existing registers and documents, check them against the method (e.g. BSI IT-Grundschutz), turn gaps into owned tasks, propose risk ratings and controls, assign evidence, prepare audit answers and reassess risks when a record changes, with no change taking effect without human approval.
Mindlapse Ernest (agentic Cyber-GRC: compliance, third-party and risk agents)
Mindlapse (Mindlapse SAS)
France
French agentic Cyber-GRC operating system whose Ernest engine runs separate planner, collector, adjudicator and writer agents to verify every governance claim (from policies, control owners or vendors) against evidence, connector signals and a cyber knowledge graph, returning sourced verdicts with confidence that are re-checked continuously and accepted or rejected by a human.
noze DataGovern (on-premise compliance agents for NIS2, GDPR and the AI Act)
noze (noze S.r.l.)
Italy
Italian on-premise platform whose AI agents read company documents and procedures, map them to NIS2, GDPR, AI Act, CRA and DORA obligations, flag gaps and risks with the source linked, and pre-fill registers, evidence and one remediation plan; a person approves every proposal and each confirmed gap becomes an owned task.
AI workforce of five lead agents and 27 specialists that runs third-party risk end to end: vendor outreach, onboarding and questionnaire chasing, document assessment, outside-in breach and score monitoring, regulatory gap analysis and remediation, and regulator-ready reporting, with Manual, Assisted or Autonomous mode set per vendor.
German agent that completes incoming security questionnaires (vendor assessments, TISAX, ISO 27001, DORA) in Excel, PDF, Word or vendor portals from the customer's policies, certificates and past answers, with a source citation on every answer, consistent answers to re-worded questions, expert routing and team approval.
AIpentix (agentic continuous security testing and agentic red teaming, by Swipergy)
Swipergy (Swipergy GmbH)
Germany
German continuous security-testing platform with an AI agent that signs in to the customer's application on its own, chooses follow-up checks and documents attack paths, with every tool run evidenced. Findings are grouped into remediation actions with owners, deadlines and Jira sync, and retests confirm fixes. Agentic red-team campaigns (recon, access, lateral and report agents led by human red teamers) are also offered for TIBER-EU and DORA TLPT style testing.
Hybridity compliance execution platform agents (policy-to-control registry, scheduled evidence and batch contract checks)
Hybridity (Hybridity AB)
Sweden
Swedish compliance execution platform for regulated firms that turns a company's own policies into a requirement registry, checks it against DORA, NIS 2, GDPR or customer demands, and hands routine work to agents (contracts checked in batches, evidence collected on schedule, updates computed when a rule changes), with a person approving every result.
A third-party risk platform run by a coordinated team of AI agents. They discover and classify vendors from identity, procurement and IT systems, collect and analyse vendor documentation and questionnaires against external attack-surface intelligence, chase vendors for missing evidence and remediation, and orchestrate approvals with humans in control.
Cloudgeni cloud agents (Compliance Remediation, Drift & Import, PR Review and other infrastructure agents)
Cloudgeni (Cloudgeni AS)
Norway
Oslo-built agentic cloud operations platform whose agents find cloud security and compliance issues, investigate across cloud state and IaC, write the Terraform/Bicep fix, validate it with a plan and policy checks and open a pull request, then verify the fix after it lands. The Compliance Remediation Agent works from Prowler, Security Hub, Defender and Checkov findings against CIS, SOC 2, ISO 27001 and NIS2. Autonomy is set by policy.
BRYTER Hybrid Agents (AI plus rule-based workflow agents for DORA, DPA and NDA contract review)
BRYTER (BRYTER GmbH)
Germany
Legal and compliance agents that combine AI document review with BRYTER's rule-based workflow engine to run specific tasks end to end, such as reviewing contracts against DORA, reviewing DPAs and NDAs against a playbook, and generating the amendment agreements or reports.
Best DORA AI agents (mechanical listing order, not a ranking) · All frameworks