What Are DORA’s Reporting Deadlines?

Under DORA Regulation (EU) 2022/2554, financial entities subject to the Act must follow a three-stage major ICT incident notification process once an incident has been formally classified. The clock starts at the moment of classification — not at the moment of discovery or initial detection.

What Counts as a “Major” ICT Incident Under DORA?

Not every system disruption triggers DORA’s reporting obligations. An ICT incident is classified as “major” under Commission Delegated Regulation (EU) 2024/1772 when it meets specified thresholds across a combination of the following criteria:

Who Must Comply with DORA Incident Reporting?

DORA Regulation (EU) 2022/2554 applies to a broad set of financial entities defined in Article 2. The following entity types are in scope for the full incident reporting regime, including the 4h/72h/1-month timeline:

Struggling with DORA incident classification?

IgeraRegTech automates it — classification in <3 minutes, pre-filled reports, automated deadline alerts. Built for financial entities operating under DORA in 2025 and beyond.

When did DORA reporting obligations come into force?

DORA Regulation (EU) 2022/2554 became fully applicable on 17 January 2025. There was no transitional period for in-scope entities. The incident reporting obligations — including the 4-hour initial notification — have been enforceable since that date. The accompanying regulatory technical standards (RTS) from EBA, ESMA and EIOPA were published in January 2025 and are directly applicable.

What happens if a financial entity misses a DORA reporting deadline?

DORA Article 50 requires Member States to empower competent authorities to impose administrative penalties and remedial measures for non-compliance. Penalties vary by jurisdiction, but national regulators such as Banco de España, the CNMV and the FCA all have broad sanctioning powers. Beyond financial penalties, a missed notification deadline can trigger enhanced supervisory scrutiny, mandatory audits, and reputational consequences in regulated markets.

Do I need to report minor ICT incidents under DORA?

No. DORA’s three-stage reporting timeline applies only to incidents classified as “major” under the criteria in Commission Delegated Regulation (EU) 2024/1772. However, financial entities must maintain an internal log of all ICT incidents — including minor ones — as part of their ICT incident management framework under Article 17. Competent authorities may request this internal log at any time.

Which authority do I report DORA incidents to in Spain or the UK?

In Spain, the relevant authority depends on entity type: credit institutions report to Banco de España, investment firms to the CNMV, and insurers to the DGSFP. All use or are implementing a common reporting platform (AGORA). In the United Kingdom, DORA does not apply directly post-Brexit, but the FCA has introduced its own operational resilience rules under PS21/3 and PS21/6 which impose similar incident notification expectations. Financial entities operating across both jurisdictions should maintain separate notification workflows.

What information must be included in the initial 4-hour DORA report?

The initial notification under Article 19(4)(a) of DORA must include: the incident reference number; the date and time of classification; an initial description of the affected systems and functions; whether there is a suspected malicious or illegal cause (such as a cyberattack); and whether the incident has or is likely to have cross-border impact on other Member States or financial entities. The format follows the ITS published by EBA/ESMA/EIOPA in January 2025.

How can IgeraRegTech help with DORA incident reporting?

IgeraRegTech is a RAG-powered compliance assistant trained on DORA Regulation (EU) 2022/2554, all published RTS/ITS, and EBA/ESMA/EIOPA Q&As. It automates incident classification against the RTS criteria, generates pre-filled notification templates for each of the three reporting stages, tracks deadlines with automated alerts, and maintains a full audit trail. Financial entities using IgeraRegTech have reduced classification time by 71% compared to manual processes. You can explore IgeraRegTech at igerasolutions.com/igeraregtech.

RegTech

Plazos de Reporte DORA 2026: Guía Completa para Entidades Financieras

Q: When did DORA reporting obligations come into force?

DORA Regulation (EU) 2022/2554 became fully applicable on 17 January 2025. There was no transitional period for in-scope entities. The incident reporting obligations — including the 4-hour initial notification — have been enforceable since that date. The accompanying regulatory technical standards (RTS) from EBA, ESMA and EIOPA were published in January 2025 and are directly applicable.

Q: What happens if a financial entity misses a DORA reporting deadline?

DORA Article 50 requires Member States to empower competent authorities to impose administrative penalties and remedial measures for non-compliance. Penalties vary by jurisdiction, but national regulators such as Banco de España, the CNMV and the FCA all have broad sanctioning powers. Beyond financial penalties, a missed notification deadline can trigger enhanced supervisory scrutiny, mandatory audits, and reputational consequences in regulated markets.

Q: Do I need to report minor ICT incidents under DORA?

No. DORA’s three-stage reporting timeline applies only to incidents classified as “major” under the criteria in Commission Delegated Regulation (EU) 2024/1772. However, financial entities must maintain an internal log of all ICT incidents — including minor ones — as part of their ICT incident management framework under Article 17. Competent authorities may request this internal log at any time.

Q: Which authority do I report DORA incidents to in Spain or the UK?

In Spain, the relevant authority depends on entity type: credit institutions report to Banco de España, investment firms to the CNMV, and insurers to the DGSFP. All use or are implementing a common reporting platform (AGORA). In the United Kingdom, DORA does not apply directly post-Brexit, but the FCA has introduced its own operational resilience rules under PS21/3 and PS21/6 which impose similar incident notification expectations. Financial entities operating across both jurisdictions should maintain separate notification workflows.

Q: What information must be included in the initial 4-hour DORA report?

The initial notification under Article 19(4)(a) of DORA must include: the incident reference number; the date and time of classification; an initial description of the affected systems and functions; whether there is a suspected malicious or illegal cause (such as a cyberattack); and whether the incident has or is likely to have cross-border impact on other Member States or financial entities. The format follows the ITS published by EBA/ESMA/EIOPA in January 2025.

Q: How can IgeraRegTech help with DORA incident reporting?

IgeraRegTech is a RAG-powered compliance assistant trained on DORA Regulation (EU) 2022/2554, all published RTS/ITS, and EBA/ESMA/EIOPA Q&As. It automates incident classification against the RTS criteria, generates pre-filled notification templates for each of the three reporting stages, tracks deadlines with automated alerts, and maintains a full audit trail. Financial entities using IgeraRegTech have reduced classification time by 71% compared to manual processes. You can explore IgeraRegTech at igerasolutions.com/igeraregtech.

Gerard Maymó

13 de junio de 2026

7 min read

Financial compliance officer reviewing DORA incident reporting timeline

#DORA reporting deadlines#DORA ICT incident reporting#DORA 2025 compliance#major ICT incident notification#DORA regulation timeline

Comparte el conocimiento con tu red

Plazos de Reporte DORA 2026: Guía Completa para Entidades Financieras

COMPARTIR

Artículos relacionados

Reglamento DORA de la UE y riesgo TIC de terceros: lo que necesitan saber los administradores de fincas

Alternativas a Wolters Kluwer Compliance 2026: RAG con IA vs Herramientas Tradicionales

Obligaciones de Gobernanza del Consejo bajo DORA 2026: Qué debe hacer realmente el Órgano de Dirección