How does DORA incident reporting work?

Direct answer

DORA requires financial entities to detect, manage, classify, and report ICT-related incidents. Major incidents must be reported to the competent authority in stages: an initial notification, followed by an intermediate report as the situation develops, and a final report once the root cause is known. The classification of what counts as "major" is based on criteria set out in the regulation and its technical standards, covering factors such as the number of clients affected, duration, geographic spread, data losses, and economic impact. Entities may also notify significant cyber threats voluntarily. Before you report, you classify. DORA and its technical standards define the thresholds that separate a major incident from a routine one, using materiality factors. Getting classification right matters because it determines whether the reporting clock starts at all. This is where a running incident process earns its place: if you cannot quickly assemble which clients, systems, and data an incident touched, you cannot classify it, let alone report it on time. DORA structures reporting in three stages. You file an initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after you became aware of it. An intermediate report follows within 72 hours as handling progresses, and a final report with root-cause analysis within one month. These time limits are set in RTS 2025/301, with the reporting templates in ITS 2025/302, under Article 19 of DORA.