{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-17-19",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/dora-agent/art-17-19)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-14",
    "fingerprint": "ewai:se:689a5f",
    "proof": "sha256:c9932a876de96f12390035faea81c02795e4f228867d7b7d3639e9cf4de0804c",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "agent_id": "agent:eu:dora:agent-dora-art-17-19",
  "agent_version": "1",
  "schema_version": "1",
  "graph_version": "2026-10-10.1",
  "section": "DORA art. 17, 18 och 19, förordning (EU) 2022/2554",
  "title": "DORA Art. 17–19 Major ICT Incident Reporting Agent",
  "question": "How must we classify a major ICT incident and when must we report it under DORA?",
  "applies_from": "2025-01-17",
  "requirements": [
    {
      "id": "requirement:eu:dora:art-17-1",
      "provision": "Art. 17(1)",
      "title": "ICT incident management process",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-17-2",
      "provision": "Art. 17(2)",
      "title": "Record all ICT incidents and significant cyber threats",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-17-3-e",
      "provision": "Art. 17(3)(e)",
      "title": "Inform senior management and the management body of major incidents",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-18-1",
      "provision": "Art. 18(1)",
      "title": "Classify incidents on six criteria (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:dora:art-19-1",
      "provision": "Art. 19(1)",
      "title": "Report major ICT incidents to the competent authority",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-19-3",
      "provision": "Art. 19(3)",
      "title": "Inform clients without undue delay",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-19-4",
      "provision": "Art. 19(4); Delegated Regulation (EU) 2025/301 art. 5",
      "title": "Initial notification, intermediate report and final report (summary)",
      "verbatim": false
    }
  ],
  "deadlines": {
    "initial_notification": {
      "hours_from_classification": 4,
      "max_hours_from_awareness": 24
    },
    "intermediate_report": {
      "hours_from_initial": 72
    },
    "final_report": {
      "months_from_last_intermediate": 1
    },
    "source": "https://eur-lex.europa.eu/eli/reg_del/2025/301/oj"
  },
  "sanctions": [
    {
      "key": "art-50-administrative",
      "provision": "Art. 50(3)–(4)",
      "authority": "National competent authorities (Art. 46)",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "amount": "set_by_member_state",
      "measures": [
        "cease-and-desist order",
        "cessation of practice",
        "measures including of pecuniary nature",
        "public notice naming the person and breach"
      ],
      "id": "sanction:eu:dora:art-50-administrative"
    },
    {
      "key": "art-35-periodic-penalty",
      "provision": "Art. 35(6)–(8)",
      "authority": "Lead Overseer (EBA, ESMA or EIOPA)",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "applies_to": "critical ICT third-party service providers",
      "max_daily_share_of_worldwide_turnover": 0.01,
      "max_months": 6,
      "id": "sanction:eu:dora:art-35-periodic-penalty"
    }
  ],
  "cases": [],
  "counts": {
    "requirements": 7,
    "controls": 4,
    "cases": 0,
    "scope_entity_types": 20
  },
  "deterministic": true,
  "agent_hash": "659f878654980d8124a10caebd5f7a2d535195d49d5c1c398452542912cc89fd",
  "hash": "sha256:c9932a876de96f12390035faea81c02795e4f228867d7b7d3639e9cf4de0804c",
  "case_note": "No DORA sanction decision with an official public source is in the register yet (DORA applies from 2025-01-17); status not_in_register.",
  "scope": {
    "entities": [
      "credit institutions",
      "payment institutions",
      "account information service providers",
      "electronic money institutions",
      "investment firms",
      "crypto-asset service providers and issuers of asset-referenced tokens",
      "central securities depositories",
      "central counterparties",
      "trading venues",
      "trade repositories",
      "managers of alternative investment funds",
      "management companies",
      "data reporting service providers",
      "insurance and reinsurance undertakings",
      "insurance and reinsurance intermediaries",
      "institutions for occupational retirement provision",
      "credit rating agencies",
      "administrators of critical benchmarks",
      "crowdfunding service providers",
      "securitisation repositories"
    ],
    "provision": "Art. 2(1)(a)–(t)",
    "note": "Gambling and betting operators are not financial entities under DORA unless they also hold one of these licences."
  },
  "endpoints": {
    "self": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-17-19",
    "node": "https://legal.exploreworldai.com/api/public/v1/node/agent/agent%3Aeu%3Adora%3Aagent-dora-art-17-19",
    "page": "https://legal.exploreworldai.com/agent/dora/art-17-19",
    "nodes": "https://legal.exploreworldai.com/graf/dora",
    "regulation": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
  },
  "not_covered": {
    "other_articles": "Art. 24–27 resilience testing and Art. 31–44 oversight of critical ICT providers are not_in_register for these agents."
  },
  "provenance": {
    "primary_source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
    "reporting_deadlines": "https://eur-lex.europa.eu/eli/reg_del/2025/301/oj",
    "read_at": "2026-10-10",
    "method": "verbatim EUR-Lex text where verbatim = true; editorial control and cross-framework mapping (unreviewed)"
  },
  "source": "Source: NovaCopilot",
  "version": "legal-2026-10-14",
  "expires": "2026-10-15T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-14+legal-2026-10-14+2026-10-14T06:44:03",
    "content_hash": "sha256:c9932a876de96f12390035faea81c02795e4f228867d7b7d3639e9cf4de0804c",
    "revalidate_after": "2026-10-14T08:05:34.908Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-17-19",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "control_mappings": 4
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}