Article 21Centralisation of reporting of major ICT-related incidents
1. The ESAs, through the Joint Committee, and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further centralisation of incident reporting through the establishment of a single EU Hub for major ICT-related incident reporting by financial entities. The joint report shall explore ways to facilitate the flow of ICT-related incident reporting, reduce associated costs and underpin thematic analyses with a view to enhancing supervisory convergence.
2. The joint report referred to in paragraph 1 shall comprise at least the following elements:
(a) prerequisites for the establishment of a single EU Hub;
(b) benefits, limitations and risks, including risks associated with the high concentration of sensitive information;
(c) the necessary capability to ensure interoperability with regard to other relevant reporting schemes;
(d) elements of operational management;
(e) conditions of membership;
(f) technical arrangements for financial entities and national competent authorities to access the single EU Hub;
(g) a preliminary assessment of financial costs incurred by setting-up the operational platform supporting the single EU Hub, including the requisite expertise.
3. The ESAs shall submit the report referred to in paragraph 1 to the European Parliament, to the Council and to the Commission by 17 January 2025.
DORA, the European Union regulation on digital operational resilience, Article 21
A feasibility study rather than an obligation. The ESAs, through the Joint Committee and in consultation with the ECB and ENISA, prepare a joint report assessing whether major-incident reporting should be centralised further through a single EU Hub — exploring how to ease the flow of reports, reduce cost and support thematic analysis and supervisory convergence.
The report must cover at least the prerequisites for establishing a Hub; benefits, limitations and risks including those from concentrating sensitive information; the interoperability needed with other reporting schemes; operational management; membership conditions; technical arrangements for access by entities and national authorities; and a preliminary assessment of the financial cost.
Nothing here falls on an entity. The report was due to the European Parliament, the Council and the Commission by 17 January 2025. It assesses an option; the article does not set up a Hub or change the reporting route in Article 19.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.