{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-19","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-19)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:eu:ce0366","proof":"sha256:b3122626661fd050dfec43513291dfff069cae93a3045da09b3aa94651a73a5e","jurisdiction":"eu","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","object_type":"article_agent","schema_version":"1.0.0","id":"agent:eu:dora:art-19","act":"dora-2022-2554","article":"19","text_sha256":"99124acf0eac92e68794e40ca5b94f77de7d7e01f005a62297f7a89cd91e62a4","obligations":["obligation:eu:dora-2022-2554-art-19-financial-entity"],"agent":"agent:eu:dora","name":"NovaCopilot DORA Agent, Article 19","title":{"en":"Reporting of major ICT-related incidents and voluntary notification of significant cyber threats","sv":"Rapportering av allvarliga IKT-relaterade incidenter och frivillig anmälan av betydande cyberhot","de":"Meldung schwerwiegender IKT-bezogener Vorfälle und freiwillige Meldung erheblicher Cyberbedrohungen"},"text":{"lang":"en","paragraphs":["1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article.","Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article.","Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB.","For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authori …","The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts.","Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of th …","2. Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.","Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, may, on a voluntary basis, notify significant cyber threats to relevant national competent authority, designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit the notification to the ECB.","Member States may determine that those financial entities that on a voluntary basis notify in accordance with the first subparagraph may also transmit that notification to the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.","3. Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident.","In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.","4. Financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:","(a)","an initial notification;"],"source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554","read_at":"2026-08-18"},"sha256":"698d62ab80887249bef2e70c6a1d18e785271c0df0f360b0aac81ca56b29caa8","duties":[{"id":"obligation:eu:dora-2022-2554-art-19-financial-entity","role":"financial-entity","duty":"Report major ICT-related incidents to the competent authority."}],"applies_to_role":{"status":"verified","roles":["financial-entity"],"entity_types":[{"role":"credit-institution","parent_role":"financial-entity","article":"2(1)(a)"},{"role":"payment-institution","parent_role":"financial-entity","article":"2(1)(b)"},{"role":"account-information-service-provider","parent_role":"financial-entity","article":"2(1)(c)"},{"role":"electronic-money-institution","parent_role":"financial-entity","article":"2(1)(d)"},{"role":"investment-firm","parent_role":"financial-entity","article":"2(1)(e)"},{"role":"crypto-asset-service-provider","parent_role":"financial-entity","article":"2(1)(f)"},{"role":"central-securities-depository","parent_role":"financial-entity","article":"2(1)(g)"},{"role":"central-counterparty","parent_role":"financial-entity","article":"2(1)(h)"},{"role":"trading-venue","parent_role":"financial-entity","article":"2(1)(i)"},{"role":"trade-repository","parent_role":"financial-entity","article":"2(1)(j)"},{"role":"aifm","parent_role":"financial-entity","article":"2(1)(k)"},{"role":"management-company","parent_role":"financial-entity","article":"2(1)(l)"},{"role":"data-reporting-service-provider","parent_role":"financial-entity","article":"2(1)(m)"},{"role":"insurer","parent_role":"financial-entity","article":"2(1)(n)"},{"role":"insurance-intermediary","parent_role":"financial-entity","article":"2(1)(o)"},{"role":"iorp","parent_role":"financial-entity","article":"2(1)(p)"},{"role":"credit-rating-agency","parent_role":"financial-entity","article":"2(1)(q)"},{"role":"critical-benchmark-administrator","parent_role":"financial-entity","article":"2(1)(r)"},{"role":"crowdfunding-service-provider","parent_role":"financial-entity","article":"2(1)(s)"},{"role":"securitisation-repository","parent_role":"financial-entity","article":"2(1)(t)"}]},"applies_to_industry":{"status":"derived","industries":["banking","insurance"]},"cross_industry_chains":{"status":"verified","shape":"rule → obligation → control → industry","chains":[{"id":"chain:dora~dora-art.-19","rule":"dora","obligation":"Reporting of major ICT-related incidents","control":"DORA art. 19","industries":["financial-services","insurance","technology"],"entity_types":[{"role":"credit-institution","label":"Credit institutions","article":"DORA art. 2(1)(a)"},{"role":"payment-institution","label":"Payment institutions","article":"DORA art. 2(1)(b)"},{"role":"account-information-service-provider","label":"Account information service providers","article":"DORA art. 2(1)(c)"},{"role":"electronic-money-institution","label":"Electronic money institutions","article":"DORA art. 2(1)(d)"},{"role":"investment-firm","label":"Investment firms","article":"DORA art. 2(1)(e)"},{"role":"crypto-asset-service-provider","label":"Crypto-asset service providers and issuers of asset-referenced tokens","article":"DORA art. 2(1)(f)"},{"role":"central-securities-depository","label":"Central securities depositories","article":"DORA art. 2(1)(g)"},{"role":"central-counterparty","label":"Central counterparties","article":"DORA art. 2(1)(h)"},{"role":"trading-venue","label":"Trading venues","article":"DORA art. 2(1)(i)"},{"role":"trade-repository","label":"Trade repositories","article":"DORA art. 2(1)(j)"},{"role":"aifm","label":"Managers of alternative investment funds","article":"DORA art. 2(1)(k)"},{"role":"management-company","label":"Management companies","article":"DORA art. 2(1)(l)"},{"role":"data-reporting-service-provider","label":"Data reporting service providers","article":"DORA art. 2(1)(m)"},{"role":"insurer","label":"Insurance and reinsurance undertakings","article":"DORA art. 2(1)(n)"},{"role":"insurance-intermediary","label":"Insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries","article":"DORA art. 2(1)(o)"},{"role":"iorp","label":"Institutions for occupational retirement provision","article":"DORA art. 2(1)(p)"},{"role":"credit-rating-agency","label":"Credit rating agencies","article":"DORA art. 2(1)(q)"},{"role":"critical-benchmark-administrator","label":"Administrators of critical benchmarks","article":"DORA art. 2(1)(r)"},{"role":"crowdfunding-service-provider","label":"Crowdfunding service providers","article":"DORA art. 2(1)(s)"},{"role":"securitisation-repository","label":"Securitisation repositories","article":"DORA art. 2(1)(t)"},{"role":"ict-third-party-service-provider","label":"ICT third-party service providers","article":"DORA art. 2(1)(u)"}]}]},"revenue_exposure":{"status":"not_in_register","reason":"member_state_penalties","sanction_article":"50","source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","via":"article 50"},"links":{"article_page":"https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-19","regulation_agent":"https://legal.exploreworldai.com/api/public/v1/article-agents?reg=dora","changes":"https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=dora"},"llm_used":false,"hash":"sha256:b3122626661fd050dfec43513291dfff069cae93a3045da09b3aa94651a73a5e","version":"legal-2026-11-02","expires":"2026-11-03T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T16:22:18","content_hash":"sha256:b3122626661fd050dfec43513291dfff069cae93a3045da09b3aa94651a73a5e","revalidate_after":"2026-11-02T23:30:17.025Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-19","disclaimer":"Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.","content_notice":{"legal_advice":false,"nature":"Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.","kinds":{"official_text":"Officiell källtext, ordagrann och ej tolkad","summary":"Sammanfattning, ej juristgranskad. Läs alltid källtexten","classification":"Automatisk märkning ur källans egen text, ej juristgranskad"},"rule":"Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-02T22:30:17.025Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-19","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":3738}}