The Financial Supervisory Authority of Norway has published a presentation outlining its 2027 expectations for banks under the Digital Operational Resilience Act (DORA). Wenche Eline Fagereng, head of IT and payment services, delivered the presentation at the Payment and Digitalization Conference on Nov. 5, 2026, emphasizing that firms must translate extensive documentation into daily risk management and controls. The message reinforces supervisory findings presented in September, when substantial implementation work had not resolved weaknesses in governance and supplier oversight.
Boards must define, approve and oversee information and communication technology (ICT) risk management frameworks and remain responsible for their implementation. Firms must maintain procedures for comprehensive oversight of suppliers and subcontractors, following deficiencies identified through inspections and registers of ICT service agreements. Contingency planning should cover both internal and outsourced ICT services. Banks should establish independent fallback arrangements capable of preserving minimum functionality during crises and test their ability to maintain critical services under scenarios involving the most severe disruptions.
Artificial intelligence and quantum security are also supervisory priorities for 2027. Banks should clearly assign organizational responsibility for artificial intelligence and address both its technological and business risks. Identification of vulnerable cryptography should begin promptly, including across supplier chains. The presentation cites Finance Norway’s roadmap and international recommendations that critical data should be protected against quantum threats by 2030 and all data by 2035, rather than presenting these dates as regulatory deadlines.