INDUSTRIES, TECHNOLOGY | Legislative Decree No. 23/2025 implementing DORA published in the Official Gazette

On 10 March 2025, Legislative Decree No. 23 (“Decree”) was published in the Official Gazette aligning Italy’s regulatory framework with the provisions of the Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (“DORA”). Most notably, the Decree designates the competent authorities responsible for overseeing compliance and enforcement, including Banca d’Italia, CONSOB, and IVASS, depending on the financial entity subject to DORA. It also identifies the entities tasked with receiving and managing reports of major ICT incidents, thus ensuring a structured and efficient response framework. In addition, the Decree introduces a rigorous administrative sanctions regime, with penalties reaching up to 10% of annual revenue in the most severe cases. In specific circumstances, disqualification measures may also apply, imposing temporary bans on directors and statutory auditors from holding key positions.

Newsletter n. 105 – March 2025