{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:dora-art-17-financial-entity","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:dora-art-17-financial-entity)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-03","fingerprint":"ewai:eu:35d8a8","proof":"sha256:d0cac4cb5b18413e51d3ea15e9e64984cbcf55fe334fe06f40b9231b02a71b16","jurisdiction":"eu","lang":"en"},"brand_source":"Source: NovaCopilot","status":"ok","id":"duty:eu:dora-art-17-financial-entity","schema_version":1,"domain":"dora","jurisdiction":"eu","act":"dora","provision":"17","obligation":"Define and implement an ICT-related incident management process.","responsible_role":{"legal_role":"financial-entity","owner_function":"IT and security"},"deadline":{"value":"not_in_register","note":null,"recipient":"internal","applies_from":null},"exceptions":[{"provision":"DORA art. 16","condition":"Small and non-interconnected investment firms, certain payment and e-money institutions exempted under PSD2/EMD, and other entities listed in art. 16.1.","effect":"reduced","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"}],"risk":{"level":"medium","basis":"Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low","max_amount":null,"max_turnover_pct":1,"sanctions":[{"id":"sanction:eu:dora-art-50","authority":"Competent authority (Article 46)"},{"id":"sanction:eu:dora-art-35-6","authority":"Lead Overseer (ESA)"}]},"evidence_chain":[{"step":1,"kind":"primary_source","ref":"DORA: Regulation (EU) 2022/2554","url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj"},{"step":2,"kind":"provision","ref":"dora 17"},{"step":3,"kind":"obligation","ref":"obligation:eu:dora-art-17-financial-entity","method":"Paraphrased from the provision text"},{"step":4,"kind":"evidence_to_keep","ref":"Dated internal record of the action"}],"source":{"title":"DORA: Regulation (EU) 2022/2554","url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj"},"recommended_action":{"do":["Define and implement an ICT-related incident management process."],"status":"derived_from_duty"},"hash":"sha256:d0cac4cb5b18413e51d3ea15e9e64984cbcf55fe334fe06f40b9231b02a71b16","what_to_do":{"timing":{"kind":"ongoing","text":"Applies on an ongoing basis while the conditions in the provision are met."},"steps":["Assign responsibility: financial-entity (IT and security).","Carry out the duty: Define and implement an ICT-related incident management process.","Document: Dated internal record of the action.","Check the wording of DORA: Regulation (EU) 2022/2554 17 before deciding."],"steps_status":"derived_from_provision","source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj"},"gaps":["statutory_deadline","reviewed_action_kit"],"links":{"obligation_graph":"https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:dora","provenance_graph":"https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:dora","action_graph":"https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:dora","self":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-17-financial-entity"},"read_at":"2026-08-31","source_label":"Source: NovaCopilot","version":"legal-2026-11-03","expires":"2026-11-06T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-03+legal-2026-11-03+2026-11-03T07:33:32","content_hash":"sha256:d0cac4cb5b18413e51d3ea15e9e64984cbcf55fe334fe06f40b9231b02a71b16","revalidate_after":"2026-11-03T08:51:54.917Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:dora-art-17-financial-entity","disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","freshness":{"freshness_class":"live","as_of":"2026-11-03T07:51:54.917Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Adora-art-17-financial-entity","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1414}}