EU regulatory register · DORA
Article 14Communication
CELEX 32022R2554 · Read on 2026-08-18
Short answer
1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-14 · Short answer as data · Official text
DORA, digital operational resilience in short
Financial entities must manage ICT risk, report major ICT incidents, test resilience and govern ICT providers by contract.
- Who is covered by DORA?
- What does Article 30 require in ICT contracts?
- How fast must an ICT incident be reported?
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.
2. As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.
3. At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.
Follow-up questions
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act