---
title: 'BAIT and DORA: the position towards the end of 2026'
url: 'https://grassroot.it/en/artikel/bait-und-dora'
markdown: 'https://grassroot.it/en/artikel/bait-und-dora.md'
lang: en
date: '2026-11-11'
description: 'Departmental applications can support important business processes. In finance, their development and operation must therefore be assessed against applicable supervisory and int…'
taxonomy:
  category:
    - 'Current developments'
  tag:
    - Compliance
---

Current developments 11.11.2026

# BAIT and DORA: the position towards the end of 2026

Departmental applications can support important business processes. In finance, their development and operation must therefore be assessed against applicable supervisory and internal requ…

 ![BAIT and DORA: the position towards the end of 2026 — symbolic illustration](https://grassroot.it/user/pages/03.artikel/05.bait-und-dora/cover.png) 

Departmental applications can support important business processes. In finance, their development and operation must therefore be assessed against applicable supervisory and internal requirements. Calling something a small file or a self-written script does not settle the question.

## The current transition

The Digital Operational Resilience Act (DORA) has applied since 17 January 2025. According to Deutsche Bundesbank, the banking supervisory requirements for information technology (BAIT) continue for institutions still within their scope. Institutions required to apply the relevant DORA risk management rules are excluded from BAIT’s scope.

Deutsche Bundesbank identifies 1 January 2027 as the transition to DORA for further financial services institutions. Full BAIT repeal is scheduled for the end of 31 December 2026. Determine which rule applies to a particular organisation and date from the relevant scope and provisions. This assessment is dated 11 November 2026. [Deutsche Bundesbank: BAIT and DORA](https://www.bundesbank.de/en/tasks/financial-supervision/individual-aspects/risk-management/bait/bait-dora-741194).

## Questions for the application

Grassroot IT starts with actual use: the operational task supported, the data processed and the possible consequences of an incorrect or missing result. Together with applicable requirements, these determine necessary checks, responsibilities and operational foundations.

The organisation decides how departmental applications enter its application inventory and existing control procedures. An application profile provides an initial overview, supplemented with required evidence such as business testing, access controls or recovery checks.

## Compliance across the lifecycle

Consider requirements during needs assessment and design. Complete the required checks and approvals before introduction. Track changes and new requirements during operation. Address retention, access rights and dependencies during replacement.

This approach can organise responsibilities and evidence transparently. Whether an individual application meets its requirements must be assessed against those requirements and its real operation. The [framework overview](https://grassroot.it/en/konzept) shows how compliance and organisational value connect all phases.

---

## Navigation

- Parent: [Articles](https://grassroot.it/en/artikel.md)
- Previous: [Develop with artificial intelligence and verify the results](https://grassroot.it/en/artikel/ki-entwicklung-pruefen.md)
- Next: [Determine an application’s organisational value](https://grassroot.it/en/artikel/wertbeitrag.md)