{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-18","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-18)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:eu:ce0366","proof":"sha256:f93d79a17bb9f475020dde3a3d7a42a98f8d101c6e28c0bf3d85c2c769ef3e34","jurisdiction":"eu"},"brand_source":"Source: NovaCopilot","object_type":"article_agent","schema_version":"1.0.0","id":"agent:eu:dora:art-18","act":"dora-2022-2554","article":"18","text_sha256":"d2008e399573c907150fea74589122404dd5a38b1e3804ffafae14a15fb47607","obligations":[],"agent":"agent:eu:dora","name":"NovaCopilot DORA Agent, Article 18","title":{"en":"Classification of ICT-related incidents and cyber threats","sv":"Klassificering av IKT-relaterade incidenter och cyberhot","de":"Klassifizierung von IKT-bezogenen Vorfällen und Cyberbedrohungen"},"text":{"lang":"en","paragraphs":["1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria:","(a)","the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact;","(b)","the duration of the ICT-related incident, including the service downtime;","(c)","the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States;","(d)","the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data;","(e)","the criticality of the services affected, including the financial entity’s transactions and operations;","(f)","the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.","2. Financial entities shall classify cyber threats as significant based on the criticality of the services at risk, including the financial entity’s transactions and operations, number and/or relevance of clients or financial counterparts targeted and the geographical spread of the areas at risk."],"source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554","read_at":"2026-08-18"},"sha256":"3746552ff7527eec9791bf7c0b75e8303df87a19e717ce1611726e29952c7a5b","duties":[],"applies_to_role":{"status":"not_in_register","roles":[]},"applies_to_industry":{"status":"derived","industries":["banking","insurance"]},"cross_industry_chains":{"status":"not_in_register","chains":[]},"revenue_exposure":{"status":"not_in_register","reason":"member_state_penalties","sanction_article":"50","source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","via":"article 50"},"links":{"article_page":"https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-18","regulation_agent":"https://legal.exploreworldai.com/api/public/v1/article-agents?reg=dora","changes":"https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=dora"},"llm_used":false,"hash":"sha256:f93d79a17bb9f475020dde3a3d7a42a98f8d101c6e28c0bf3d85c2c769ef3e34","version":"legal-2026-11-02","expires":"2026-11-03T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T16:22:18","content_hash":"sha256:f93d79a17bb9f475020dde3a3d7a42a98f8d101c6e28c0bf3d85c2c769ef3e34","revalidate_after":"2026-11-02T22:17:31.533Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-18","disclaimer":"Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.","content_notice":{"legal_advice":false,"nature":"Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.","kinds":{"official_text":"Officiell källtext, ordagrann och ej tolkad","summary":"Sammanfattning, ej juristgranskad. Läs alltid källtexten","classification":"Automatisk märkning ur källans egen text, ej juristgranskad"},"rule":"Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-02T21:17:31.533Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-18","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1356}}