ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
DORA incident reporting runs on three deadlines, and the first one is measured from a moment you control: the classification. Commission Delegated Regulation (EU) 2025/301 requires the initial notification as early as possible and in any case within four hours of classifying an incident as major — and no later than 24 hours from the moment you became aware of it.
That construction catches people out in both directions. Classify quickly and the four-hour clock starts immediately; classify slowly and the 24-hour awareness cap bites anyway. This guide sets out the three reports, the exact time limits, what happens when you miss one, and the weekend rule that does not apply to everybody.
| Report | Time limit | Clock starts |
|---|---|---|
| Initial notification | As early as possible, within 4 hours — and no later than 24 hours | 4 hours from classification as major; 24 hours from becoming aware of the incident |
| Intermediate report | Within 72 hours | From submission of the initial notification — due even if nothing has changed |
| Final report | Within one month | From the intermediate report, or from the latest updated intermediate report |
Three details in the Regulation are worth reading carefully, because they change how a DORA incident reporting process has to be built.
Late classification does not forgive the four hours. Where an entity has not classified an incident as major within 24 hours of becoming aware of it but classifies it as major later, the initial notification is still due within four hours of that classification. There is no version of this where the clock does not start.
The intermediate report is due regardless of progress. It must be submitted within 72 hours of the initial notification even where the status or the handling of the incident has not changed. Entities must also submit an updated intermediate report without undue delay, and in any case once regular activities have been recovered.
Missing a deadline is itself a reportable act. An entity unable to submit within the time limits must inform the competent authority without undue delay — no later than the relevant time limit — and explain the reasons for the delay. Silence is the one option the Regulation does not leave open.
Where a deadline falls on a weekend day or a bank holiday in the entity’s Member State, the report may be submitted by noon of the next working day. That concession is narrower than it first appears.
It does not apply to the initial notification or the intermediate report for credit institutions, central counterparties, operators of trading venues, or other financial entities identified as essential or important entities under Article 3 of the NIS2 Directive. And competent authorities may disapply it for other financial entities that are significant or have a systemic character nationally or at Union level.
For a bank, then, a major incident detected on a Saturday morning is a Saturday morning notification. Any on-call rota built on the assumption that weekend incidents can wait until Monday is built on a concession that does not apply.
The Delegated Regulation sets the content alongside the time limits, and the implementing standards provide the harmonized templates and the forms and procedures for submission. Practically, the three reports answer three different questions:
The practical constraint of DORA incident reporting is that the first report is due while you still know almost nothing, which is exactly the intent — regulators want early sight, not a finished investigation. Build a template that can be completed honestly with partial knowledge and that flags what is unknown, rather than one that waits for certainty.
Every deadline in this regime hangs off the classification decision, so the process that decides “is this major?” is the one that determines whether reporting is achievable. That assessment runs against criteria including clients and financial counterparties affected, data losses, reputational impact, duration and service downtime, geographical spread, and economic impact — with materiality thresholds attached.
Three practices make it work under pressure:
Our DORA compliance checklist covers where incident reporting sits alongside the other obligations, and the five pillars puts it in context.
Is DORA incident reporting a 4-hour or a 24-hour rule?
Both. The initial notification is due within four hours of classifying the incident as major, and in any case no later than 24 hours from becoming aware of it.
What if the incident is classified as major only days later?
The initial notification is due within four hours of that classification. The late classification does not remove the obligation.
Do we still file an intermediate report if nothing has changed?
Yes — the Regulation requires it within 72 hours of the initial notification even where the status or handling has not changed.
Can deadlines be extended?
There is no general extension. An entity that cannot meet a limit must tell the competent authority by that limit and explain why.
Does the weekend concession apply to us?
Not if you are a credit institution, central counterparty, trading venue operator, or a NIS2 essential or important entity — and possibly not if your competent authority has disapplied it for significant entities.
Solve classification first, because every DORA incident reporting deadline is derived from it. Record the awareness timestamp, give one named person the classification decision with pre-agreed thresholds, and build report templates that can be filed with partial knowledge. Then check whether the weekend concession applies to your entity type — for banks, CCPs, trading venues and NIS2 essential and important entities, it does not, and that single fact reshapes the on-call rota.
Incident classification criteria, report templates and the register behind them are in the DORA Compliance Toolkit, or start with the free ISO templates.
September 2, 2026
September 2, 2026
September 2, 2026
September 2, 2026
September 2, 2026