Article 4Proportionality principle
What it says
1. Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.
2. In addition, the application by financial entities of Chapters III, IV and V, Section I, shall be proportionate to their size and overall risk profile, and to the nature, scale and complexity of their services, activities and operations, as specifically provided for in the relevant rules of those Chapters.
3. The competent authorities shall consider the application of the proportionality principle by financial entities when reviewing the consistency of the ICT risk management framework on the basis of the reports submitted upon the request of competent authorities pursuant to Article 6(5) and Article 16(2).
DORA, the European Union regulation on digital operational resilience, Article 4
What it means in practice
Proportionality, and the article is narrower than the word suggests. The whole of Chapter II, the ICT risk management rules, is to be applied in proportion to the entity’s size and overall risk profile and to the nature, scale and complexity of its services, activities and operations. For incident management (Chapter III), testing (Chapter IV) and the key principles on third-party risk (Chapter V, Section I), proportionality applies too, but only as those chapters specifically provide.
Competent authorities must take that into account when they review an entity’s ICT risk management framework, using the review reports they can request under Articles 6(5) and 16(2).
The article tells entities to apply the rules in proportion; it does not itself excuse any duty. The lighter treatment the Regulation gives is written into particular articles: reduced duties for microenterprises, the simplified framework in Article 16, and threat-led testing only for entities that authorities identify under Article 26.
The detail on how to judge increased or reduced complexity is in the regulatory technical standards under Articles 15 and 16(3), Commission Delegated Regulation (EU) 2024/1774. Check the current text for amendments.
What is in the packs for this
From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.
- Excel
DORA Proportionality & Scope Assessment
The whole workbook sets what kind of entity you are, so that the depth of each duty follows size, risk and complexity. - Excel
DORA Article-to-Control Mapping Library
Requirement Library rows RQ-02: Apply the rules in proportion. Each gives the provision in plain words, what to show and the documents that help. - Excel
DORA Readiness Self-Assessment
Readiness items SC-01: Scope, profile and proportionality decided and recorded. Each rates how ready the entity is, with the evidence and the gap. - Word
ICT Risk Management Framework Document Template
Scope and proportionality section: the proportionality log (FW-03). - Excel
DORA Documentation & Evidence Checklist
Evidence records EV-01: The scope and proportionality assessment, approved by the management body. Each lists the records a supervisor can ask for.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.