The need for supervised firms to fully and effectively comply with the DORA regulation, with procedures tested in practice and management actively involved, was stressed by Vasiliki Lazarakou, president of the Hellenic Capital Market Commission, at the Cyber Security Forum 2026.
“To be clear, that means not simply having policies and procedures on paper. It means they must have been tested and that these procedures work effectively in practice,” she said.
Management accountability in focus
She placed particular emphasis on the responsibility of boards, noting that accountability is often pushed down to lower levels of the hierarchy, even though it rests with management itself, according to the relevant announcement.
“They often push responsibility down, when it should sit at the top — with them,” she said.
She added that “digital resilience requires a strategic choice, adequate resources, clear accountability and systematic oversight”. She also made clear that “responsibility for managing technology risks can in no way be transferred to technology itself. It remains with management and the relevant corporate bodies”.
Implementing DORA is a key supervisory priority for the Hellenic Capital Market Commission. In this context, Ms Lazarakou stressed the importance of clearly allocating responsibilities, having effective control mechanisms, and putting appropriate business continuity and recovery plans in place.
“Compliance should be a meaningful investment in a company’s resilience and sustainability,” she said.
Risks from external providers and the cloud
The Hellenic Capital Market Commission president also highlighted financial firms’ growing reliance on external technology service providers and cloud computing infrastructure.
“An incident at one provider can affect many firms at the same time and trigger knock-on effects,” she warned, underlining that managing these dependencies is an integral part of digital resilience.
The two sides of artificial intelligence
On artificial intelligence, Ms Lazarakou said it can improve the detection of suspicious transactions and the early identification of threats, but can also be used to carry out more sophisticated cyberattacks and digital fraud.
“Threats are evolving much faster than in the past and are becoming harder to detect,” she said, stressing the need for appropriate security policies, continuous risk assessment and investment in specialist staff.
In closing, she stressed that DORA’s effectiveness depends on embedding its requirements in firms’ day-to-day operations.
“It is an investment in trust, in stability and in our ability to respond to the challenges of tomorrow,” she said of cybersecurity.
The Cyber Security Forum 2026 is organised by Tsomokos Communications under the auspices of the Ministry of National Defence, the Ministry of Digital Governance, the National Cyber Security Authority and the Hellenic Capital Market Commission, with EXL Consulting as Content Partner.