IBM Designated as a Critical Third-Party Provider Under EU DORA

IBM (NYSE: IBM) was designated on Dec 5, 2025 by the European Supervisory Authorities (EBA, EIOPA, ESMA) as a critical ICT third-party provider under DORA.

Rhea-AI Summary

IBM (NYSE: IBM) was designated on Dec 5, 2025 by the European Supervisory Authorities (EBA, EIOPA, ESMA) as a critical ICT third-party provider under DORA.

The designation places IBM in-scope for supervision by the ESAs and signals its central role supporting the operational resilience of Europe’s financial sector. IBM says it will work with the ESAs, strengthen cybersecurity and governance, and support financial institutions in meeting their own DORA obligations ahead of DORA implementation.

Priorities listed include collaboration with regulators, supporting clients' compliance, and continued investment in resilience and security.

Positive

• Designated as a critical ICT provider under DORA on Dec 5, 2025
• Commits to support financial clients’ DORA compliance and resilience

Negative

• Placed in-scope for supervision by European Supervisory Authorities
• Subject to DORA implementation requirements and supervisory oversight

Argus Dec 5 session

-0.02% close to close Open Argus

Details

News Market Reaction – IBM

On Dec 5, the day this news came out, IBM closed 0.02% below the previous close.

Data tracked by StockTitan Argus for the Dec 5 session.

Key Figures

Q3 2025 Revenue: $16.331 billion Prior-year Revenue: $14.968 billion Diluted EPS: $1.84 +5 more

Q3 2025 Revenue

$16.331 billion

Total revenue, Q3 2025 10-Q

Prior-year Revenue

$14.968 billion

Total revenue, prior-year quarter

Diluted EPS

$1.84

Q3 2025 EPS from continuing operations

Gross Profit

$9.36 billion

Q3 2025 10-Q

SG&A Expense

$4.748 billion

Q3 2025 10-Q

R&D Expense

$2.082 billion

Q3 2025 10-Q

Cash from Operations

$9.153 billion

Year-to-date through Sep 30, 2025

Remaining Performance Obligations

about $64 billion

As of Sep 30, 2025

Historical Context

5 past events · Latest: Nov 20

5 events

1. Nov 20

   Quantum collaboration

   24h Move

   +0.7%

   Plan with Cisco to build network of large-scale quantum computers.

2. Nov 19

   Semiconductor R&D

   24h Move

   -0.5%

   Research collaboration on next-gen semiconductor technologies and new fab facility.

3. Nov 14

   AI sports partnership

   24h Move

   +0.3%

   Launch of AI-driven In-Fight Insights platform with UFC using watsonx.

4. Nov 13

   AI data study

   24h Move

   -3.2%

   Global CDO study highlighting gap between AI ambition and data readiness.

5. Nov 12

   Quantum roadmap

   24h Move

   +0.4%

   New quantum processors, software, and milestones toward advantage and fault tolerance.

24h Move is the share-price change in the day after each event; other market factors may also have contributed.

Key Terms

digital operational resilience act (dora), information and communication technology (ict), european supervisory authorities, operational resilience, +1 more

5 terms

digital operational resilience act (dora) regulatory

"The Digital Operational Resilience Act (DORA) is a European Union regulation"

A regulatory framework that requires financial firms to prepare for, withstand and quickly recover from digital disruptions by setting rules on IT risk management, incident reporting, testing and third-party service oversight. For investors, it matters because it raises standards for operational reliability and cybersecurity—similar to requiring stronger locks and emergency plans for a building—reducing the chance of costly outages, data breaches or unexpected losses that can hurt value and confidence.

information and communication technology (ict) technical

"critical Information and Communication Technology (ICT) providers can withstand"

Information and communication technology (ICT) means the tools and systems used to create, store, send and receive digital information — examples include computers, networks, software, and telecom services. For investors, ICT matters because it underpins how companies operate, reach customers and control costs; think of it as the plumbing and roads of the modern economy, where better infrastructure often leads to faster growth, lower risk and clearer competitive advantage.

european supervisory authorities regulatory

"designated by the European Supervisory Authorities (EBA, EIOPA, ESMA) as a critical"

European Supervisory Authorities are independent regulators at the EU level that oversee banks, insurance companies and financial markets to ensure they follow common rules and stay stable. For investors, they matter because their guidance, decisions and enforcement shape the safety of financial firms and the rules for trading and disclosure—like referees and traffic signals that keep markets fair, predictable and less prone to sudden shocks.

operational resilience technical

"strengthen operational resilience across Europe's financial ecosystem"

Operational resilience is a company’s ability to keep its essential functions running when faced with disruptions like cyberattacks, supply chain failures, or natural disasters. Think of it as a shock absorber and backup generator for the business: stronger resilience limits lost revenue, safeguards reputation, and reduces the chance of regulatory penalties, all of which matter to investors assessing a company’s steady cash flow and long-term risk.

cyber incidents technical

"withstand and recover from technology disruptions, including cyber incidents"

Cyber incidents are events where a company’s computer systems, networks, or digital data are accessed, damaged, disrupted, or stolen without permission—this can include hacks, data breaches, outages, or other failures of digital security. They matter to investors because they can cause direct financial losses, regulatory penalties, customer loss and downtime; think of it like a burglary or fire for a company’s digital assets that can hurt revenue, increase costs and damage the company’s reputation and stock price.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

ARMONK, N.Y., Dec. 5, 2025 /PRNewswire/ -- The Digital Operational Resilience Act (DORA) is a European Union regulation designed to ensure that financial entities—such as banks, insurance companies, and investment firms—and their critical Information and Communication Technology (ICT) providers can withstand and recover from technology disruptions, including cyber incidents and technical failures.

IBM (NYSE: IBM) was recently designated by the European Supervisory Authorities (EBA, EIOPA, ESMA) as a critical ICT third-party provider under DORA. This designation reflects the essential role that technology providers like IBM play in supporting the resilience of Europe's financial sector.

The objective is clear: strengthen operational resilience across Europe's financial ecosystem, mitigate systemic risk, and ensure trust in the stability and security of digital services.

What This Means for IBM and our Clients

IBM has long been a trusted partner to the world's financial services firms, with decades of experience supporting the financial sector and collaborating with financial regulators and oversight bodies worldwide.

This designation places IBM in-scope for supervision by European Supervisory Authorities as a critical third-party provider, and we will work closely with the ESAs to ensure operational and technical resilience that is critical to Europe's financial system.

For our clients, this designation reinforces IBM's longstanding commitment to operational resilience and regulatory compliance. We will continue to provide guidance and resources to help financial institutions meet their own DORA obligations while maintaining innovation and competitiveness.

Ahead of DORA's implementation, we have worked across our technology and services units to address requirements for both IBM and our clients, contributing to an EU-wide framework that protects the stability of Europe's financial system. We continually strengthen our cybersecurity technologies, defenses, and governance worldwide to meet the highest standards of security and operational resilience.

We look forward to constructive engagement with the European Supervisory Authorities and to drawing on our deep expertise in risk management, cybersecurity, and regulatory compliance to help clients navigate evolving requirements with confidence.

Our priorities include:

• Collaborating with regulators to ensure compliance and transparency
• Supporting financial institutions in meeting their own DORA obligations
• Investing in resilience to safeguard stability and trust in digital services

Together, we can help Europe's financial ecosystem remain secure, resilient, and ready for the future. 

Learn more:

• Trust at IBM
• What is DORA
• DORA Action Guide

About IBM 

IBM is a leading global hybrid cloud and AI, and business services provider, helping clients in more than 175 countries capitalize on insights from their data, streamline business processes, reduce costs and gain the competitive edge in their industries. Thousands of governments and corporate entities in critical infrastructure areas such as financial services, telecommunications and healthcare rely on IBM's hybrid cloud platform and Red Hat OpenShift to affect their digital transformations quickly, efficiently and securely. IBM's breakthrough innovations in AI, quantum computing, industry-specific cloud solutions and business services deliver open and flexible options to our clients. All of this is backed by IBM's legendary commitment to trust, transparency, responsibility, inclusivity and service.

For more information, visit https://research.ibm.com.

Media contact:

Lobna Hassan
IBM
lobna.hassan@ibm.com

View original content to download multimedia:https://www.prnewswire.com/news-releases/ibm-designated-as-a-critical-third-party-provider-under-eu-dora-302633575.html

SOURCE IBM

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What did IBM announce about DORA on December 5, 2025?

IBM said it was designated by EBA, EIOPA and ESMA as a critical ICT third-party provider under DORA.

What does the DORA designation mean for IBM (NYSE: IBM)?

The designation means IBM is in-scope for supervision by European Supervisory Authorities under DORA.

How will IBM support financial institutions under DORA requirements?

IBM will provide guidance, resources, and technical support to help clients meet DORA obligations.

Will IBM work with European regulators following the DORA designation?

Yes; IBM said it will work closely with ESAs to ensure operational and technical resilience.

Does the DORA designation affect IBM’s cybersecurity commitments?

IBM stated it will continue investing in cybersecurity, defenses, and governance to meet high standards.

When does IBM’s DORA-related supervision begin?

IBM’s designation was announced on Dec 5, 2025, placing it immediately in-scope for ESA supervision ahead of DORA implementation.