DORA and End-User Computing: How Financial Institutions Should Govern EUCs and Where Apparity Can Help

DORA and EUCs at a glance

Table of Contents

1. What is DORA?
2. What counts as an EUC?
3. Are EUCs in scope under DORA?
4. What have ESMA and BaFin said?
5. What does DORA require for EUCs?
6. What controls and evidence are needed?
7. How does DORA apply to AI tools?
8. Common implementation challenges
9. How should firms approach compliance?
10. How Apparity supports DORA EUC compliance
11. How does DORA relate to BCBS 239 and RDARR?
12. Frequently asked questions
13. Regulatory sources

What is DORA, and who does it apply to?

The Digital Operational Resilience Act, or DORA, is an EU regulation that establishes common requirements for managing information and communication technology risk across the financial sector. It applies to a broad range of regulated financial entities, including banks, investment firms, insurers, asset managers, payment institutions, and certain information and communication technology (ICT) third-party service providers.

DORA entered into force on January 16, 2023, and has applied since January 17, 2025. It applies to a broad range of financial entities operating in or providing services to the EU. Its aim is to ensure that financial institutions can withstand, respond to, and recover from ICT-related disruptions — and it establishes harmonized, enforceable requirements to make that happen.

The regulation covers ICT governance, risk management, incident reporting, resilience testing, and third-party oversight.

Global financial groups may also be affected where their EU-regulated entities fall within DORA’s scope or where ICT services support those entities.

For EUC governance teams, the key issue is that DORA’s ICT requirements are not limited to centrally managed infrastructure and enterprise applications. Business-managed technology, including material spreadsheets and other EUC tools, may also need to be incorporated into the institution’s ICT risk-management framework.

What counts as an EUC under DORA?

End-user computing, or EUC, generally refers to applications, files, scripts, models, and tools that are developed, managed, or operated by business users rather than through the central ICT function. Under DORA, these tools may qualify as ICT assets when they are used within a financial entity’s network and information systems.

Common examples include:

• Excel spreadsheets and financial models
• Microsoft Access databases
• Macros and user-developed scripts
• Business-managed reporting applications
• Low-code and no-code tools
• Locally developed workflow applications
• Shadow IT systems
• Certain business-developed AI assistants or agents

EUC is not a separate legal asset class under DORA. The relevant question is whether the tool falls within the regulation’s broad definition of an ICT asset and whether its use creates operational, data, security, or resilience risk.

Not every spreadsheet or business-developed application requires identical controls. Financial institutions should determine the appropriate governance based on factors such as business criticality, complexity, data sensitivity, ownership, frequency of use, and potential operational impact.

Are EUC tools in scope under DORA?

Yes. EUC tools can fall within DORA’s scope because the regulation defines ICT assets broadly to include software and hardware used within a financial entity’s network and information systems. The European Securities and Markets Authority (ESMA) has specifically confirmed that EUC tools and systems developed or managed outside the ICT function can qualify as ICT assets.

What DORA says

Article 3(7) of DORA defines an ICT asset as a software or hardware asset used within the network and information systems of a financial entity. This definition does not create a separate exemption for spreadsheets, Access databases, shadow IT, or other business-managed applications.

Financial institutions should therefore avoid treating EUCs as a separate category that sits outside the ICT risk framework. Material EUCs should be identified, assessed, controlled, monitored, and documented in a manner proportionate to their risk.

The ESMA and Germany’s Federal Financial Supervisory Authority (BaFin) have each provided guidance supporting this interpretation.

What has ESMA said about EUC tools?

ESMA has expressly stated that EUC tools are considered ICT assets under DORA’s broad definition. Its official Q&A also indicates that the same interpretation applies to software governed through end-user licence agreements and to systems developed or managed outside the ICT function.

In DORA Q&A 2103, answered on February 11, 2024, ESMA explained that EUC tools are software or hardware used within a financial entity’s network and information systems. As a result, the DORA requirements applying to ICT assets—including identification, documentation, security, risk assessment, and management—also apply to relevant EUC tools.

This means institutions should not rely on organizational ownership alone when determining scope. A tool does not fall outside DORA merely because it was developed by a finance, risk, operations, or business team rather than by ICT.

What has BaFin said about EUC tools?

BaFin’s non-binding supervisory guidance indicates that EUCs do not receive a separate or lighter status under DORA. The same risk-management principles that apply to purchased or centrally managed applications may also apply to business-developed applications.

In its DORA supervisory statement, BaFin explains that no distinction is made between EUC applications and purchased standard applications. It also notes that testing may need to be more extensive than under previous approaches because EUCs do not receive a special regulatory status.

BaFin’s later guidance on ICT risks associated with AI similarly states that DORA does not distinguish between applications developed within the ICT function and applications developed outside it.

BaFin’s publications are supervisory guidance rather than amendments to the DORA regulation itself. They are nevertheless important indicators of how BaFin expects regulated entities to interpret and implement the framework.

Institutions supervised by BaFin should be prepared to explain how they identify and govern applications developed outside the central ICT function, including how testing, ownership, change management, and risk assessment are applied.

What does DORA specifically require for EUC tools?

DORA does not prescribe a separate EUC control framework. Instead, material EUCs should be incorporated into the institution’s broader ICT risk-management framework and governed according to their risk, criticality, complexity, and role in supporting business services.

For most financial institutions, this translates into several practical governance requirements.

The objective is not to apply maximum controls to every file. It is to show that the institution has a defensible process for identifying risk, assigning accountability, applying proportionate controls, and evidencing that those controls operate in practice.

What controls and evidence should institutions maintain for EUCs?

Institutions should maintain controls and evidence that correspond to the risk presented by each EUC. For higher-risk tools, this may include documented ownership, risk assessments, approvals, access reviews, testing records, change histories, version records, backup procedures, exception reports, and periodic certifications.

The exact control set will vary by institution, but the following mapping provides a practical starting point.

This table is a practical interpretation of DORA-aligned EUC governance and is not a verbatim reproduction of the regulation. Institutions should tailor their controls to their regulatory status, internal policies, risk taxonomy, and competent-authority guidance.

During an audit or supervisory review, institutions should be able to show not only that policies exist, but also that the relevant EUCs were identified, assessed, assigned controls, monitored, and remediated when exceptions occurred.

Does DORA require the same controls for every EUC?

No. DORA is based on risk management and proportionality, so institutions do not need to apply identical controls to every spreadsheet, database, script, or business-developed application. Controls should reflect the EUC’s criticality, complexity, data sensitivity, operational impact, and role in supporting important business functions.

A low-risk spreadsheet used for an informal internal calculation may require little more than basic ownership and retention. A complex model used for regulatory reporting, risk calculations, valuation, liquidity management, or financial close may require formal testing, change control, access management, backup, approval, and ongoing monitoring.

A defensible EUC program should therefore establish clear materiality thresholds and control tiers rather than attempting to govern every file in the same way.

How does Apparity support DORA-aligned EUC governance?

Apparity helps financial institutions discover, inventory, assess, control, and monitor business-managed applications and files within a centralized EUC governance program. The platform supports the operational processes and evidence institutions may need when incorporating material EUCs into their broader ICT risk-management frameworks.

Apparity does not determine an institution’s legal obligations or replace its regulatory interpretation. It provides technology and workflows that can help operationalize the institution’s chosen EUC governance framework.

How does DORA EUC governance relate to BCBS 239 and RDARR?

The EU’s DORA requirements, the Basel Committee on Banking Supervision’s BCBS 239 principles, and the European Central Bank’s (ECB) expectations for risk data aggregation and risk reporting address different regulatory objectives, but they overlap where EUCs support risk data, financial reporting, regulatory submissions, models, or critical operational processes.

• DORA focuses on ICT risk and digital operational resilience.
• BCBS 239 focuses on the accuracy, completeness, timeliness, and adaptability of risk data aggregation and reporting.
• The ECB’s Effective Risk Data Aggregation and Risk Reporting (RDARR) guidance reinforces expectations concerning data governance, lineage, architecture, controls, and management oversight.

DORA is the primary driver of EUC governance requirements for EU financial institutions, but it sits within a broader and reinforcing regulatory landscape. The ECB’s RDARR guidance, published in May 2024, explicitly calls out EUC applications as part of institutions’ data governance obligations — and RDARR was the worst-rated sub-category of internal governance across the entire 2023 Supervisory Review and Evaluation Process (SREP) cycle.

For banks subject to BCBS 239 — the Basel Committee’s principles for risk data aggregation and reporting — the EUC governance gap and the data quality gap are often two names for the same problem. EUC-managed files that feed regulatory reports, risk models, or NAV calculations sit at the intersection of both frameworks. Organizations subject to both DORA and BCBS 239 will find that strong EUC governance addresses obligations across the board.

A spreadsheet or business-developed application that supports risk aggregation, regulatory reporting, valuation, liquidity, capital, or net asset value calculations may create obligations across more than one framework. A well-designed EUC governance program can therefore support multiple regulatory and control objectives.