Leading European technology provider ALSO Group argues that “proof over promises” is needed to keep systems compliant in a post-DORA world.
Last year, the European IT landscape breathed a collective sigh of relief; the January 2025 deadline for the Digital Operational Resilience Act (DORA) had passed.
Many organisations treated it like a finish line – a one-and-done marathon of paperwork and technical audits. Looking ahead to 2026, however, it is clear that this finish line was only a starting block for the next era of building a competitive edge for businesses.
A recent report from Boston Consulting Group warns that Europe’s digital infrastructure faces a serious “resilience gap”and that a large-scale or prolonged outage could cause cascading crises across essential services, including payments, financial stability and emergency response systems.
Mark Appleton, group lead vendor ecosystem development at ALSO Group, stresses that this report, amongst similar warnings, highlights exactly why 2026 is the year resilience must become measurable, necessitating an evolved role across cloud partners and IT providers.
“Resilience has evolved in today’s market to become more than just a checkbox for the risk department, and instead to be a commercial differentiator and legal obligation in the post-DORA era,” says Appleton.
“Against a backdrop of machine-speed threats and interconnected supply chains, orchestrated resilience paves the way for an antifragile business strategy to gain advantage. Europe’s digital ecosystem is now so interconnected that a failure anywhere can quickly escalate to failures everywhere.”
“The shift from implementation to enforcement is already visible in supervisory behaviours. Regulators need more than just seeing policy on paper; they are now demanding real-time proof of continuity under stress test audits.
“It’s now just as important to be able to display how your multi-vendor ecosystem behaves when a primary cloud region goes dark or a critical SaaS provider faces a breach.”
Appleton continues by highlighting the differences in mindset for smarter, competitive cloud partners.
“Smart cloud partners already understand that fragmented systems and untested failover mechanisms are now operational liabilities, not IT nuisances.
“Under DORA, a vulnerability in your smallest sub vendor is a vulnerability in you. The supply chain is effectively treated as a single digital organism. Financial entities that historically relied on internal post-mortems will struggle unless they automate resilience testing, reporting and vendor governance.
“Now, accountability is squarely extended to ICT third-party providers, including cloud platforms and MSPs, with ESA now empowered to designate critical third-party providers for direct insight.
“A vulnerability anywhere in the digital supply chain is now treated as a vulnerability everywhere. Therefore, a continuous, data-backed validation of operational readiness is key to the resilience that businesses will need to align with in 2026.”
Appleton further outlines that proving resilience is built into cloud operations – into their DNA – is the key to staying competitive in 2026.
“A practical roadmap for 2026 involves mapping your digital dependency stack, building multi-vendor resilience into your architecture, automating your incident reporting, and strengthening vendor governance through clear exit strategies.
“A cloud marketplace is rapidly becoming the de facto compliance registry in Europe. By aggregating configuration data, identity controls, activity logs and posture monitoring across multi-vendor environments, it turns resilience into a measurable, data-driven workflow rather than an annual fire drill.”
Appleton concludes, “From integrated DRaaS to automated incident reporting, proven resilience demonstrates operational readiness every single day. As large-scale outage scenarios become more plausible, customers will gravitate toward partners who can offer real-time evidence of continuity.”
