DORA major incident reporting deadlines

The DORA major incident reporting deadlines are the clocks that tell a financial entity when to report a major ICT (information and communication technology) incident to its competent authority, from the initial notification to the final report. The duty comes from Article 19 of Regulation (EU) 2022/2554 (DORA) and has bound a bank, an insurer or a crypto-asset service provider alike since January 17, 2025. The clocks sit in Article 5 of Delegated Regulation (EU) 2025/301, published in the Official Journal on February 20, 2025 together with Implementing Regulation (EU) 2025/302, which sets the single template for all three stages (Annex I) and its data glossary (Annex II). Initial notification: as early as possible, no later than four hours after the incident is classified as major, and no later than 24 hours after the entity became aware of it. Intermediate report: no later than 72 hours after the initial notification, even if nothing has changed, then updated when regular activities have recovered. Final report: no later than one month after the intermediate report or its latest update. A deadline that falls on a weekend or bank holiday can be met by noon on the next working day. That extension does not apply to the initial notification or the intermediate report of credit institutions, central counterparties, trading venue operators and entities that are essential or important under NIS2. An entity that cannot meet a deadline tells the authority without undue delay, and no later than that deadline, and explains why. The two caps on the initial notification stack: past hour twenty without a classification, the four-hour window no longer exists. For the underwriter, those first hours bill at night and weekend rates, from the vendor and from breach counsel alike. The response costs section picks them up if the wording reaches legally required reporting in general; if it reaches only personal data breaches, a DORA incident with no data involved stays outside. One caveat: the intermediate report runs from the initial notification, not from detection, so a late first filing shifts the whole chain, and the delay itself can end in a penalty whose insurability is open to debate.