Share on LinkedInShare on LinkedIn

ARTICLE · 04 JULY 2023

Enforcing DORA: £80k Fine For CIO's Failed IT Migration

William Fry LLP
William Fry LLP
Contributor
William Fry LLP

William Fry LLP

William Fry advises leading Irish and international companies, covering both the public and private...

View firm profile
Explore more from William Fry LLP

In this article, we consider a recent fine imposed by the UK's Prudential Regulation Authority (PRA) against a Chief Information Officer for operational resilience failures under the Senior...

European UnionMedia, Telecoms, IT, Entertainment
John O'Connor
John O'Connor
Shane Kelleher
Shane Kelleher
Eoin Caulfield
Eoin Caulfield
Author LinkedIn connections

The Digital Operational Resilience Act (Regulation EU 2022/2554) (DORA) aims to improve operational resilience in regulated financial service providers (RSFPs), which fall under its scope, enabling them to withstand ICT-related disruptions and threats. DORA will apply from 17 January 2025.

In this article, we consider a recent fine imposed by the UK's Prudential Regulation Authority (PRA) against a Chief Information Officer for operational resilience failures under the Senior Manager Certification Regime (SMCR), the UK equivalent of the Central Bank of Ireland's (CBI) incoming Individual Accountability Framework (IAF). We also discuss the enforcement powers of competent authorities such as the CBI and potential penalties which will apply under DORA.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

EU Kids Act: What Do The Planned Age Restrictions And Safety Requirements For Minors Online Mean For Providers?

The European Commission has proposed the EU KIDS Act, introducing comprehensive restrictions on minors' access to social media and video-sharing platforms while imposing extensive online safety requirements across digital services. This landmark legislation will require businesses to implement safety-by-design frameworks, age verification systems, and guardian controls, with particularly stringent compliance obligations for Very Large Online Platforms that must prove their services are safe through independ
European UnionMedia, Telecoms, IT, Entertainment
Winston Taylor
Winston Taylor
Article

The EU Kids Act: Not Just A Social Media Ban, And Not Just An EU Problem

The European Commission has proposed the EU KIDS Act, a comprehensive regulation that extends far beyond a simple social media ban for under-13s. This ambitious framework introduces tiered age-based restrictions, safety-by-design obligations across digital services including AI chatbots and online games, and mandatory certified age-verification systems. With potential fines reaching 6% of global turnover and enforcement mechanisms piggybacking on existing DSA machinery, organisations offering digital servic
European UnionMedia, Telecoms, IT, Entertainment
Burges Salmon LLP
Burges Salmon LLP
Article

Advertising In ChatGPT: What Retailers Need To Know

OpenAI's integration of advertisements into ChatGPT marks a significant shift in how retailers can reach consumers through conversational AI. As this emerging channel offers contextual relevance at moments of genuine purchasing intent, retailers must navigate complex advertising regulations, data protection requirements, and sector-specific rules to ensure compliance while capitalizing on this novel marketing opportunity.
United KingdomMedia, Telecoms, IT, Entertainment
Browne Jacobson LLP
Browne Jacobson LLP
Article

Evolution Delivered: What Regulation (EU) 2026/2202 Means For EU261 Reform

The European Union has enacted its most comprehensive overhaul of passenger rights legislation in over twenty years, introducing significant operational changes for airlines while maintaining the core architecture of the existing compensation framework. With implementation required by October 2027, carriers face expanded obligations around automatic reimbursements, rerouting rights, and assistance provisions, alongside new clarity on extraordinary circumstances and claims procedures.
European UnionMedia, Telecoms, IT, Entertainment
Burges Salmon LLP
Burges Salmon LLP
Article

AI And In-house Legal Practice: Professional Judgement Cannot Be Automated

Generative AI offers genuine opportunities for in-house legal teams, but it also creates distinct professional risks that require careful management. Recent regulatory guidance from the Law Society and SRA warning notices highlight critical concerns around AI-generated legal work, from fabricated case citations to confidential data exposure. How should in-house lawyers balance AI efficiency gains against their professional duties and regulatory obligations?
United KingdomMedia, Telecoms, IT, Entertainment
Farrer & Co
Farrer & Co
Article

EU KIDS Act: Europe's Plan To Strengthen Child Online Safety

The European Commission has proposed the EU KIDS Act, a comprehensive regulatory framework establishing a minimum age of 15 for social media access and mandating safety-by-design principles for digital services accessible to minors. This analysis explores how the Act's four pillars compare with the UK's Online Safety Act, examines its relationship with existing EU digital regulations including the DSA and upcoming Digital Fairness Act, and outlines the practical compliance implications for platforms operati
European UnionMedia, Telecoms, IT, Entertainment
TLT
TLT
Article

UK Government Announces Social Media Ban For Under-16s: Enforcement And Next Steps

The UK Government has announced plans to ban social media platforms from offering services to children under 16, marking a significant escalation in the country's approach to children's online safety. The proposal extends beyond a blanket ban to target harmful functionality including livestreaming and certain messaging features, with platforms expected to implement robust age assurance measures and demonstrate effective compliance with child safety requirements. Organisations operating in-scope services fac
United KingdomMedia, Telecoms, IT, Entertainment
Stephenson Harwood
Stephenson Harwood
Article

Government Legislative Priorities For Autumn 2026

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.
IrelandGovernment, Public Sector
William Fry LLP
William Fry LLP
Article

Ireland’s Data Centre Connections: Back Online

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la
IrelandEnergy and Natural Resources
William Fry LLP
William Fry LLP
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

Data For Sale: Can Insolvent Companies Realise The Value Of Corporate Data?

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.
IrelandInsolvency/Bankruptcy/Re-Structuring
William Fry LLP
William Fry LLP