Neither DORA nor the UK Bill Reaches the Small Firms Taking 43% of Attacks

This file tests the 2025 regulatory reforms recorded at 25-0117, 25-1113, 25-1119 and 25-1124 against the small-organisation population described in this section.

DORA applies to EU financial entities, with extension to critical ICT providers. The UK Bill covers essential and digital services, managed service providers, data centres and designated critical suppliers.

Scoping upward is deliberate and defensible: regulation targets systemic risk, and a ten-person firm is not systemically important. The corpus filed at 25-1124 that criticality is emergent and hard to designate in advance, and that difficulty argues for focusing where the dependency concentration is.

Small firms are suppliers. Marquis at 25-0814, Chain IQ at 25-0613 and the health IT vendor at 25-0515 were not household names, and criticality was visible only after the incident.

A designation regime that reaches organisations already recognised as critical will not reach the next Marquis, which is the specific criticism this desk made at 25-1124.

The corpus has been consistent that duties without capacity produce non-compliance rather than security, at 25-1223, and 25-0612b establishes that a third of small firms could not absorb a $10,000 loss.

What that population needs is not an obligation. It is secure defaults in the products they already buy — the administrative consent default at 25-0311, the enrolment controls at 25-0813, the automatic deletion at 25-0903 — decided by platform vendors on behalf of customers who cannot make the decision themselves.

That is the argument at 25-0923, where a platform with no fault held the only lever operating at the scale of the problem. For small organisations it is the only lever at all.

Graded medium: this is a reading of published instruments against a survey-based population estimate, not a legal analysis.