DORA incident-reporting technical standards published in the Official Journal

Commission Delegated Regulation (EU) 2025/301 (regulatory technical standards) and Commission Implementing Regulation (EU) 2025/302 (standard forms and templates) were published in the Official Journal on 20 February 2025, fixing the content, format and clock for major ICT-related incident reporting under DORA. The time limits in the RTS: the initial notification is due as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from the moment the entity became aware of it; the intermediate report within 72 hours of the initial notification, even where nothing has changed, with an update when regular operations resume; the final report no later than one month after the (latest updated) intermediate report. Deadlines falling on weekends or bank holidays may shift to the next business day for some entities, but not for those designated significant by their competent authority. The ITS supplies the mandatory templates (Annexes I–IV).

Incident reporting under DORA is now a form with a clock: a four-hour classification-to-notification window is an operational capability, not a policy statement. Playbooks written before February 2025 were drafted without these exact timers and templates and need to be reconciled against them.

The incident-response, security-operations and regulatory-reporting teams inside every DORA financial entity — the deadlines land on whoever owns the classification-to-notification chain, usually across at least two teams.