Departmental applications can support important business processes. In finance, their development and operation must therefore be assessed against applicable supervisory and internal requirements. Calling something a small file or a self-written script does not settle the question.
The current transition
The Digital Operational Resilience Act (DORA) has applied since 17 January 2025. According to Deutsche Bundesbank, the banking supervisory requirements for information technology (BAIT) continue for institutions still within their scope. Institutions required to apply the relevant DORA risk management rules are excluded from BAIT’s scope.
Deutsche Bundesbank identifies 1 January 2027 as the transition to DORA for further financial services institutions. Full BAIT repeal is scheduled for the end of 31 December 2026. Determine which rule applies to a particular organisation and date from the relevant scope and provisions. This assessment is dated 11 November 2026. Deutsche Bundesbank: BAIT and DORA.
Questions for the application
Grassroot IT starts with actual use: the operational task supported, the data processed and the possible consequences of an incorrect or missing result. Together with applicable requirements, these determine necessary checks, responsibilities and operational foundations.
The organisation decides how departmental applications enter its application inventory and existing control procedures. An application profile provides an initial overview, supplemented with required evidence such as business testing, access controls or recovery checks.
Compliance across the lifecycle
Consider requirements during needs assessment and design. Complete the required checks and approvals before introduction. Track changes and new requirements during operation. Address retention, access rights and dependencies during replacement.
This approach can organise responsibilities and evidence transparently. Whether an individual application meets its requirements must be assessed against those requirements and its real operation. The framework overview shows how compliance and organisational value connect all phases.