DORA Compliance API — Instant Answers With EUR-Lex Citations

Gibs is a digital operational resilience act API that answers DORA compliance questions with article-level EUR-Lex citations. Unlike traditional DORA compliance software that relies on static checklists, Gibs provides DORA automation through a programmable REST interface. It covers all 64 articles of DORA (Regulation 2022/2554) plus all 12 delegated acts — RTS and ITS on DORA ICT risk management, incident reporting, contractual arrangements, and more. The corpus contains over 1,000 indexed chunks and scores 93%+ accuracy on evaluation questions.

The Problem

Financial entities have faced DORA compliance obligations since January 17, 2025. The regulation spans 64 articles organized across five pillars, supplemented by 12 delegated acts that specify detailed technical standards for ICT risk management, incident classification, incident reporting timelines, contractual arrangements with ICT third-party providers, subcontracting conditions, and threat-led penetration testing.

Most compliance tools are web-based questionnaires or static PDF checklists. None offer programmatic access. Developers building compliance checks into internal tools, onboarding flows, or audit pipelines have to manually search EUR-Lex, cross-reference delegated acts against parent articles, and parse legal text themselves. That workflow does not scale.

How Gibs Solves This

One API call returns structured JSON with article-level citations from the full DORA corpus — base regulation and delegated acts included.

Python:

import gibs

client = gibs.Client(api_key="sk-gibs-...")

result = client.check(
    question="What are the DORA incident reporting timelines?",
    regulations=["dora"]
)

print(result.answer)
# "Under DORA Article 19, financial entities must submit an initial
#  notification within 4 hours of classifying a major ICT-related
#  incident, an intermediate report within 72 hours, and a final
#  report within one month..."

print(result.sources)
# ["Article 19(4)(a)", "Article 19(4)(b)", "Article 19(4)(c)",
#  "RTS 2025/301 Article 2"]

TypeScript:

import { Gibs } from '@gibs-dev/sdk'

const gibs = new Gibs({ apiKey: 'sk-gibs-...' })

const result = await gibs.check({
  question: 'What contractual clauses does DORA require for ICT providers?',
  regulations: ['dora']
})
// result.sources: ["Article 30(2)", "Article 30(3)", "RTS 2024/1773"]

Gibs also provides a native MCP (Model Context Protocol) server at mcp.gibs.dev. AI coding assistants like Cursor, Claude Desktop, and Windsurf can call Gibs directly to answer regulatory questions within your development environment.

What DORA Covers

DORA is structured around five pillars:

| Pillar | Articles | Key Requirements | |--------|----------|-----------------| | ICT Risk Management | Articles 5-16 | Risk management framework, governance, protection, detection | | Incident Reporting | Articles 17-23 | Classification, 4h/72h/1mo timeline, notification to authorities | | Digital Operational Resilience Testing | Articles 24-27 | Vulnerability assessments, threat-led penetration testing (TLPT) | | Third-Party Risk | Articles 28-44 | Contractual requirements, register of information, oversight | | Information Sharing | Article 45 | Voluntary sharing of cyber threat intelligence |

These articles are supplemented by 12 delegated acts (RTS and ITS) that provide detailed technical standards. For example, RTS 2024/1774 specifies ICT risk management framework requirements, RTS 2025/301 details incident reporting procedures, and RTS 2024/1773 defines mandatory contractual clauses for ICT third-party arrangements. Gibs indexes all of them and cites both the parent article and the specific delegated act provision in its responses.

Why Programmatic Access Matters

DORA compliance software traditionally means GRC platforms with manual questionnaires. But DORA has 64 articles supplemented by 12 delegated acts — the detailed technical requirements change how you manage ICT risk, report incidents, structure vendor contracts, and test resilience. Teams building internal compliance tools, automated vendor onboarding, or regulatory reporting workflows need DORA ICT risk management answers on demand, not through a web portal.

Gibs makes DORA automation practical: embed compliance checks in CI/CD pipelines, generate cited regulatory references for audit reports, or build internal chatbots that answer DORA questions for your compliance team. Every response includes both the parent regulation article and the specific delegated act provision, with CELEX numbers for EUR-Lex verification.

Who This Is For

Gibs is a programmatic compliance query engine. It returns structured answers with citations. It is not a GRC platform, audit tool, or consulting firm.

Try It Now

Free tier: 50 requests per month, no credit card required.

curl -X POST https://api.gibs.dev/v1/check \
  -H "Authorization: Bearer sk-gibs-..." \
  -H "Content-Type: application/json" \
  -d '{"question": "Does DORA apply to crypto-asset service providers?", "regulations": ["dora"]}'

Get your API key | Read the docs | Try the MCP server

FAQ

Does Gibs cover DORA delegated acts (RTS/ITS)?

Yes. Gibs indexes all 12 delegated acts adopted under DORA, including RTS on ICT risk management (2024/1774), incident classification (2024/1772), incident reporting (2025/301), contractual arrangements (2024/1773), subcontracting (2025/532), TLPT (2025/1190), and more. When you query about detailed requirements, Gibs cites both the parent DORA article and the specific delegated act provision.

What accuracy does Gibs achieve on DORA questions?

Gibs scores 93%+ accuracy on 50 evaluation questions covering factual recall, cross-references, and adversarial edge cases.

Can I query DORA and other regulations in the same request?

Yes. Gibs supports cross-regulation queries. A question like "How does DORA interact with GDPR for incident data?" returns cited answers from both regulations, with clear attribution of which obligation comes from which regulation. Gibs currently covers DORA, the EU AI Act, and GDPR.

How current is the DORA corpus?

The DORA corpus includes the base regulation (2022/2554) and all 12 delegated acts adopted through February 2026. Corpus versions are tracked and included in every API response so you always know which version was used to generate the answer.

Is there an MCP server for AI assistants?

Yes. Gibs provides a native MCP (Model Context Protocol) server at mcp.gibs.dev. AI coding assistants like Cursor, Claude Desktop, and Windsurf can call Gibs directly to answer regulatory questions within your development environment. See the MCP documentation for setup instructions.

What format does the API return?

JSON with structured fields: answer text, source citations (article numbers), confidence score, regulation version, and processing metadata. Every citation references a specific article — not just a recital or chapter heading.

Last updated: 2026-02-19