The Digital Operational Resilience Act (DORA) sets uniform rules for digital resilience in the financial sector — what does this mean for e‑invoicing providers?
EU Regulation 2022/2554 entered into force on 17 January 2025. An IT provider can be critical for one client but not for another — the assessment lies with the financial institution itself.
DORA sets uniform rules for digital resilience in the financial sector. Financial entities must manage ICT risks and reflect specific obligations in contracts with their IT vendors.
DORA distinguishes between standard ICT services and services supporting critical or important functions: if the failure of a service would materially impair a firm's financial performance or regulatory compliance, it triggers additional contractual obligations.
Must be included in every contract between a financial firm and an IT provider:
Additional requirements when a service supports a critical or important function:
In the CAL&F case study, e-invoicing is generally seen as an ancillary process:
Does not directly affect lending or factoring
Can be temporarily replaced by paper invoices
Many alternative providers available
Many financial firms deem e-invoicing non-critical and apply only basic Article 30(2) requirements. However, the final classification always rests with the bank or factoring company.
If a service provider considers its service non-critical, it sends a negative declaration — a statement that:
Even if a function is deemed non-critical, the contract must include mandatory Article 30(2) elements:
Provider agrees to give access to data and liaise with supervisory authorities.
Provider helps investigate and resolve ICT incidents at no extra cost.
Rules for retrieving data upon contract termination or provider insolvency.
Provider takes part in client's training and testing activities.
Invoice-Portal's logs and data enable clients to meet their monitoring and reporting duties: every event is recorded, documents are preserved in original form, and reports can be produced on demand.
GEBA: Germany Finally Has a B2B E-Invoicing Address — and It Is Coming to Peppol
/in eInvoice NewsThe German Electronic Business Address turns one this month and is being registered in the Peppol EAS code list. What GEBA is, how it differs from the Leitweg-ID, and how to build one.
France Goes Live on 1 September 2026: Every VAT-Registered Business Must Be Able to Receive
/in eInvoice NewsFrom 1 September 2026 every VAT-registered business in France must receive e-invoices through an approved platform, and large companies and ETIs must issue and e-report. What changes, and what to check now.
Business Validation: How to Check Your E-Invoice Quickly and Correctly
/in eInvoice NewsValid XML is not the same as an accepted invoice. Learn the three layers of e-invoice validation — schema, business rules and recipient checks — and how to test your file in under a minute.
Denmark’s Proposed Opt-Out Peppol Model: Implications for Businesses
/in eInvoice NewsDenmark plans to make Peppol the default e-invoicing channel from 1 January 2027. Businesses must decide whether to adopt or opt out by 1 December 2026.
Romania 2026: New Tightening of E-Invoicing and B2C Regulations
/in eInvoice NewsRomania steps up its e-invoicing and B2C rules from 1 January 2027. Local and certain non-resident businesses must comply with new formats and strict deadlines.
Germany’s E-Invoice Reporting System: What Companies Should Know Now
/in eInvoice NewsGermany is planning a digital reporting system based on the e-invoice. Peppol, invoice service providers, and ERP integration are set to become key elements.