Knowledge · DORA · Article 19
Major incidents are reported in three steps.
Financial entities must report major ICT-related incidents to their competent authority: an initial notification, an intermediate report and a final report. Clients whose financial interests are affected must be informed without undue delay.
What it requires
In plain words.
- Classify ICT-related incidents and identify the major ones, using the criteria in Article 18
- Send an initial notification, an intermediate report and a final report to the competent authority
- Follow the deadlines in the technical standards: initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, intermediate report within 72 hours, final report within one month
- Inform affected clients without undue delay, including the measures taken
- Significant cyber threats may be notified voluntarily
Plain-language summary of DORA Article 19 (Regulation (EU) 2022/2554). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
The clock starts when the incident is classified as major, so classification has to be fast and documented. Every report needs the same facts – collect them once.
- ProcessAn incident flow with classification against the DORA criteria
- DeadlinesClocks for the initial, intermediate and final report, with reminders
- FormsOne incident record that fills in every report
- EvidenceEvery report, approval and timestamp kept with the incident
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See DORA article 19
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.