The European Supervisory Authorities provide further guidance on the practical application of DORA reporting requirements for major ICT-related incidents.
On 16 September 2026, the European Supervisory Authorities (EBA, EIOPA and ESMA – together, the “ESAs”) published new “DORA Incident Reporting – Operational Instructions”. The document supplements the existing regulatory framework for reporting major ICT-related incidents with practical guidance on the use of the reporting templates and is intended, in particular, to promote more consistent reporting practices and improve the quality of reported data.
Table of Contents
The new Operational Instructions do not change the substantive reporting obligations under DORA. Nevertheless, they are of considerable practical importance for financial entities: they indicate the areas in which the supervisory authorities have observed inconsistent or error-prone reporting practices since the introduction of DORA incident reporting and set out the approach they expect going forward.
The regulatory framework
The central reporting obligation is set out in Article 19 DORA. Under this provision, financial entities must report major ICT-related incidents to the competent authority. Reporting takes place in several stages – by means of an initial notification, an intermediate report and a final report.
The details regarding the content and deadlines for these reports are laid down in Delegated Regulation (EU) 2025/301. Accordingly, the initial notification must generally be submitted within four hours of classifying the incident as major and no later than 24 hours after becoming aware of the incident. The intermediate report generally follows no later than 72 hours after the initial notification, while the final report must be submitted no later than one month after the intermediate report or the latest updated intermediate report.
Implementing Regulation (EU) 2025/302 contains the standard forms, templates and procedural requirements to be used for this purpose.
The newly published Operational Instructions build on this existing regulatory framework. They therefore do not create an additional formal Level 2 framework, but instead address the practical handling of the reporting procedure already in force.
Emerging supervisory expectations
The legal status of the Operational Instructions is noteworthy. The ESAs expressly clarify that the guidance is provided by ESA staff on a “best efforts” basis only. It is not intended to constitute a legal interpretation or an official position of the ESAs. At the same time, however, the guidance has been coordinated with the competent national authorities and is intended to be updated continuously on the basis of further experience with DORA incident reporting.
Accordingly, the Operational Instructions do not have normative binding force comparable to DORA or the delegated and implementing acts adopted under it.
For practical purposes, however, it would be too simplistic to regard them merely as non-binding guidance. Rather, the document describes in considerable detail the approach that the supervisory authorities consider appropriate within the existing legal framework. Financial entities should therefore expect these supervisory expectations to be reflected in ongoing supervisory practice.
Focus: consistent and reliable reporting data
The Operational Instructions contain a total of 14 points of guidance on the practical completion of DORA reports. Their focus is less on new substantive legal requirements and more on the consistency and quality of the data submitted.
For example, the ESAs point out that the information used to uniquely identify an incident must remain unchanged throughout the entire reporting cycle. Changes between the initial notification, intermediate report and final report may otherwise result in an incident being recorded more than once from a technical perspective.
Corrections to reports already submitted should likewise not be made merely on an isolated basis. Instead, as a general rule, a new version of the most recently submitted report should be provided, containing both the correction and all other information on the incident that is current at that time.
This makes clear that the ESAs do not view the individual reports in isolation. Rather, the initial notification, intermediate report and final report form a coherent reporting lifecycle within which the information must be updated in a transparent and traceable manner.
Long-running incidents in focus
The clarification regarding the treatment of long-running incidents is also likely to be of particular practical importance.
The Operational Instructions assume that, following the initial notification and the first intermediate report, at least one further intermediate report should be submitted every month for as long as a final report cannot yet be provided. The ESAs derive this from the deadline for the final report laid down in Delegated Regulation (EU) 2025/301.
Particularly in the case of complex cyber incidents, technical recovery may already have been completed while root-cause analysis, loss assessment or forensic investigations continue over a longer period. Companies should therefore ensure that their internal reporting processes are capable of accommodating such extended reporting cycles.
Incidents involving ICT third-party service providers
Further guidance concerns incidents originating from an ICT third-party service provider or another financial entity.
For such cases, the ESAs envisage more standardised identification of the affected service provider, in particular by using its full legal name and an appropriate identifier such as an LEI or EUID.
This point also illustrates the close interrelationship between DORA incident reporting and ICT third-party risk management. In the event of an incident, financial entities must be able to identify the affected service provider clearly and at short notice and have the relevant master data available for reporting purposes.
This is particularly relevant for payment and electronic money institutions, as their technical service provision regularly relies to a significant extent on external infrastructure, cloud and software providers.
Practical implications
The Operational Instructions make clear that the supervisory focus in DORA incident reporting is increasingly extending beyond mere compliance with reporting deadlines to encompass the substantive consistency and quality of reported data.
Financial entities should therefore compare their existing incident reporting processes against the new guidance. This applies in particular to internal reporting and escalation processes, the versioning of submitted reports, the unique identification of incidents and the availability of the information on ICT third-party service providers required for reporting.
The Operational Instructions do not require a fundamental restructuring of incident management processes. However, they provide a useful opportunity to review existing DORA incident reporting playbooks and internal completion guidance to determine whether they adequately reflect the supervisory practice that is now emerging.
Conclusion
With the new Operational Instructions, the ESAs are further developing DORA incident reporting at an operational level. They do not create new substantive reporting obligations. However, the document provides, for the first time, a comparatively detailed insight into the experience gained by European and national supervisory authorities with the practical implementation of DORA reporting obligations since their introduction.
This is precisely where their significance lies: the guidance shows where, from the supervisory authorities’ perspective, further refinement is needed and how the existing regulatory requirements are intended to be applied as consistently as possible going forward.
