Article 20Harmonisation of reporting content and templates
The ESAs, through the Joint Committee, and in consultation with ENISA and the ECB, shall develop:
(a) common draft regulatory technical standards in order to:
(i) establish the content of the reports for major ICT-related incidents in order to reflect the criteria laid down in Article 18(1) and incorporate further elements, such as details for establishing the relevance of the reporting for other Member States and whether it constitutes a major operational or security payment-related incident or not;
(ii) determine the time limits for the initial notification and for each report referred to in Article 19(4);
(iii) establish the content of the notification for significant cyber threats.
When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations, and in particular, with a view to ensuring that, for the purposes of this paragraph, point (a), point (ii), different time limits may reflect, as appropriate, specificities of financial sectors, without prejudice to maintaining a consistent approach to ICT-related incident reporting pursuant to this Regulation and to Directive (EU) 2022/2555. The ESAs shall, as applicable, provide justification when deviating from the approaches taken in the context of that Directive;
(b) common draft implementing technical standards in order to establish the standard forms, templates and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat.
The ESAs shall submit the common draft regulatory technical standards referred to in the first paragraph, point (a), and the common draft implementing technical standards referred to in the first paragraph, point (b), to the Commission by 17 July 2024.
Power is delegated to the Commission to supplement this Regulation by adopting the common regulatory technical standards referred to in the first paragraph, point (a), in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
Power is conferred on the Commission to adopt the common implementing technical standards referred to in the first paragraph, point (b), in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
DORA, the European Union regulation on digital operational resilience, Article 20
The mandate that turns Article 19 into something an entity can actually do. The ESAs, through the Joint Committee and in consultation with ENISA and the ECB, develop draft regulatory technical standards setting the content of major-incident reports (reflecting the Article 18(1) criteria), the time limits for the initial notification and each later report, and the content of a notification of a significant cyber threat. They also develop draft implementing technical standards for the forms, templates and procedures.
In doing so they must weigh the entity’s size and risk profile and the nature, scale and complexity of its activities, so that time limits may differ by financial sector, while keeping a consistent approach with NIS2.
Both instruments are adopted: Commission Delegated Regulation (EU) 2025/301 (content and time limits) and Commission Implementing Regulation (EU) 2025/302 (forms and templates). Anyone building an incident process needs them alongside the Regulation, because this is where the clock and the form come from. Check for amendments before relying on the text.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.