Under DORA, a financial entity must send its initial notification of a major ICT-related incident as early as possible, within four hours of classifying it as major and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial one, and a final report within a month after the intermediate report.
Where the numbers come from
DORA Article 19 sets the structure: an initial notification, an intermediate report and a final report. Article 20 delegated the timing and content to technical standards. Those are in Commission Delegated Regulation (EU) 2025/301, Article 5.
The timings in Article 5(1):
- Initial notification: as early as possible, and in any case within four hours from classification as major and no later than 24 hours from the moment the entity became aware of the incident.
- Intermediate report: at the latest within 72 hours from the initial notification, even if nothing has changed. An updated one follows without undue delay once regular activity is recovered.
- Final report: no later than one month after the intermediate report, or after the latest updated intermediate report.
Late classification
If an entity has not classified the incident as major within 24 hours of awareness but does so later, Article 5(2) says the initial notification is due within four hours of that classification.
Weekends and delays
Article 5(4) allows submission by noon the next working day when a deadline falls on a weekend or bank holiday. Article 5(5) removes that relief for credit institutions, central counterparties, trading venue operators and other financial entities identified as essential or important under NIS2, and competent authorities can remove it for significant or systemic entities. If you cannot meet a deadline, tell the authority before it passes and explain why.
What each report contains
- Initial: incident reference, detection date and time, classification and the criteria met, description, member states affected, how it was discovered, origin if known, whether a continuity plan was activated.
- Intermediate: occurrence time, recovery time, type of incident, threats and techniques used, affected functions and infrastructure, impact on clients, other authorities informed, temporary actions and indicators of compromise where applicable.
- Final: root causes, resolution dates, how it was resolved, information for resolution authorities, direct and indirect costs and losses, and recurring incidents.
Preparing the process
- Write the classification criteria from DORA Article 18 into your runbook. They cover clients affected, duration, geographic spread, data losses, criticality of services and economic impact.
- Capture time of awareness and time of classification separately in the ticket.
- Pre-fill report templates with your entity identifiers.
- Decide who classifies. A four hour clock leaves no room for a committee to be found.
- Rehearse with a scenario that includes a third-party failure, since you stay responsible for reporting even if you outsource the filing (Article 19(5)).
Safeguard's compliance and evidence automation can help keep timestamps and supporting records together.
Quick check
When does the four hours start?
At classification of the incident as major, not at the start of the incident. The 24 hour outer limit runs from awareness.
Is this the same as NIS2 reporting?
No. NIS2 uses 24 hours, 72 hours and one month. The DORA standards were designed to be consistent with, and at least equivalent in effect to, the NIS2 approach, but the times differ.
Sources
Last reviewed: 19 October 2026.
