DORA, förordning (EU) 2022/2554 · gäller från 2025-01-17
IKT-incidenter och rapportering, DORA art. 17–19
Finansiella företag ska ha en process för IKT-incidenter, klassificera dem efter sex kriterier och rapportera allvarliga incidenter till behörig myndighet i tre steg: första anmälan, mellanrapport och slutrapport.
Krav
Art. 17(1) ICT incident management process
Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.
Art. 17(2) Record all ICT incidents and significant cyber threats
Financial entities shall record all ICT-related incidents and significant cyber threats.
Art. 17(3)(e) Inform senior management and the management body of major incidents
ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;
Art. 18(1) Classify incidents on six criteria (summary)
Incidents are classified on: clients and counterparts affected and reputational impact; duration and downtime; geographical spread (notably more than two Member States); data losses; criticality of services affected; and economic impact.
Sammanfattning, inte ordagrann text.
Art. 19(1) Report major ICT incidents to the competent authority
Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article.
Art. 19(3) Inform clients without undue delay
Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident.
Art. 19(4); Delegated Regulation (EU) 2025/301 art. 5 Initial notification, intermediate report and final report (summary)
Initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report within one month of the latest intermediate report.
Sammanfattning, inte ordagrann text.
Frister
- Första anmälan: inom 4 timmar efter att incidenten klassats som allvarlig, senast 24 timmar efter att företaget fått kännedom om den.
- Mellanrapport: inom 72 timmar efter första anmälan.
- Slutrapport: inom 1 månad efter senaste mellanrapport.
- Källa: delegerad förordning (EU) 2025/301, sammanfattning.
Sanktioner
Art. 50(3)–(4): varje medlemsstat fastställer administrativa sanktioner och åtgärder. Det finns inget gemensamt EU-belopp.
Art. 35(6)–(8): kritiska IKT-leverantörer kan få vite på upp till 1 procent av genomsnittlig daglig global omsättning, i högst sex månader.
No DORA sanction decision with an official public source is in the register yet (DORA applies from 2025-01-17); status not_in_register.
Vem omfattas
Finansiella företag enligt art. 2.1 a–t (20 typer), bland annat banker, betalinstitut, försäkringsbolag, fondbolag, värdepappersbolag och kryptotjänstleverantörer. Spelbolag omfattas inte om de inte också har ett sådant tillstånd.
- Agent:
- agent:eu:dora:agent-dora-art-17-19
- Källa:
- EUR-Lex, läst 2026-10-10
- Noder:
- /graf/dora
Kontrollkopplingar och kopplingar till GDPR, SEC och CCPA finns i NovaCopilot med partnernyckel. Source: NovaCopilot.