Norway Finanstilsynet Replaces the IKT Regulation with Adapted DORA Rules for Additional Financial-Sector Entities and Establishes an Interim Incident-Reporting Procedure

From September 1, 2026, Norway's national IKT Regulation is repealed and financing undertakings, real estate brokerage undertakings, debt collection undertakings and Norsk naturskadepool become subject to selected provisions of Regulation (EU) 2022/2554 (DORA), with the adaptations established by Chapter 2 of the amended Norwegian DORA Regulation (FOR-2026-08-20-1657).

The framework covers proportionality, ICT risk governance, incident management and reporting, digital operational resilience testing, ICT third-party risk, contract registers, follow-up of recommendations concerning critical ICT providers and cyber-threat information sharing.

Scope limitations apply, including settlement-function limitations for real estate brokerage undertakings and size-based contract-notification requirements for debt collection undertakings. Finanstilsynet also announced that Altinn form KRT-3190 cannot be used until further notice.

Reports of major incidents and significant cyber threats must be sent to hendelse@finanstilsynet.no - mailto:hendelse@finanstilsynet.no; sensitive submissions may use KRT-1060 marked 'Hendelsesrapportering IKT' or an encrypted, password-protected Word attachment.

Reports must include occurrence and detection times, contact details, affected systems/data, preliminary consequences, known cause, restoration timing or estimate, recovery measures and recurrence-prevention measures.

Impact

Impact assessment: High.

Key reasons: binding ICT and cybersecurity governance duties apply from September 1, 2026, the former IKT Regulation is repealed, and covered entities must use an interim reporting channel immediately.

Who is affected?

Financing, real estate brokerage and debt collection undertakings, Norsk naturskadepool, their ICT governance teams and relevant service providers.

Conclusion:

affected entities should confirm their applicable DORA provisions, update ICT contracts and registers, and implement the temporary incident-reporting procedure without delay.