YTYK You think you know

Card 8 of 15 Incidents — classify, then report three times ●●● Sharp edge

The clocks are not in the Regulation

Article 19 requires three submissions for a major incident — an initial notification, an intermediate report and a final report. The deadlines are not in DORA: they sit in a regulatory technical standard, Delegated Regulation (EU) 2025/301.

Why it is like this

Deadlines tuned to operational reality need to be changeable without reopening a regulation. Delegating them to RTS is what lets the detail move; it is also why reading DORA alone leaves you without the numbers.

Not to be confused with

NIS2's 24 hours, 72 hours and one month. Those are printed in the NIS2 directive itself and run to a CSIRT. DORA's run to a financial supervisor and are counted from two different events: the initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours from becoming aware of it; the intermediate report 72 hours after the initial notification, even if nothing has changed; the final report one month after the latest intermediate report.

In practice

Article 5(2) closes the loop the other way: if you have not classified within 24 hours of awareness and classify later, the initial notification is then due 4 hours from that classification. So the 24-hour cap bites only when classification happened inside it — the clock you are actually racing is the classification decision.

There is also a weekend rule. If a deadline lands on a weekend or a bank holiday you may file by noon on the next working day — except for credit institutions, central counterparties, trading venue operators and entities that are essential or important under NIS2, who get no such relief on the initial or intermediate report.

Source: Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting — Art. 5, with DORA Art. 19. Read on .

Connects to

  • NIS2 — NIS2 puts its 24h / 72h / one-month clocks in the directive itself
Predict Check yourself

A firm becomes aware of an incident on Monday at 09:00 but only classifies it as major on Wednesday at 14:00. When is the initial notification due?

  1. Thursday 18:00 — four hours from classification. Article 5(2) covers late classification, so the 24-hour cap only applies where classification happened within it.
  2. Tuesday 09:00 — 24 hours from awareness, which is an absolute outer limit.
  3. Wednesday 18:00 — four hours from classification.
  4. Immediately, since the 24-hour limit has already been breached.
Show the answer

Wednesday 18:00 — four hours from classification.

Four hours from a Wednesday 14:00 classification is Wednesday 18:00. The trap is reading the 24-hour figure as an absolute backstop: it caps the case where you classified in time, and Article 5(2) governs the case where you did not.