DORA incident reporting: deadlines and who to tell

A bank, insurer, investment firm or payment institution that has a major ICT-related incident reports it to its competent authority in three steps, and the first has a clock of hours. This page gives the rule as the legal text states it, then what Jira does by itself, then what Dueline does.

What DORA says

Article 19 of the Digital Operational Resilience Act (Regulation (EU) 2022/2554) asks a financial entity to notify its competent authority of a major ICT-related incident, in three reports, on the templates of Article 20. The time limits are in Article 5 of Delegated Regulation (EU) 2025/301. DORA has applied since 17 January 2025.

• Initial notification: within 4 hours of classifying the incident as major and no later than 24 hours from becoming aware of it. An incident classified as major more than 24 hours after you became aware of it is due 4 hours from the classification.
• Intermediate report: within 72 hours of the initial notification, even when nothing has changed, and an updated one when regular activities are recovered.
• Final report: one month after the latest intermediate report.

Two details change the date. A deadline that falls on a weekend or a bank holiday may move to noon of the next working day, except the initial and intermediate reports of credit institutions, central counterparties, trading venues and NIS2 entities. And a deadline you cannot meet is reported before it passes, with the reasons.

Which incidents are major is your assessment, against the classification criteria. National supervisors may add their own rules.

What Jira does by itself

Jira holds the incident as a work item and can show who works on it and its status. It has a Due date field, which is a date and has no time, so it cannot say “4 hours from 09:30”. A custom date and time field can hold a time, and an automation rule can fill it, but nothing in Jira knows that the first report runs from the classification and the second from the first. That arithmetic, and the weekend move, stay in a spreadsheet or in someone’s head.

What Dueline does

Dueline is our app. On the work item, Qualify asks when you became aware of the incident and, for DORA, when it was classified as major. It then lists the three reports with their deadlines, shows the later noon the weekend rule allows beside the strict time, and counts a report late only after it. You send each report to the competent authority yourself and press Record as sent with when it was sent and the reference. The next report’s deadline starts from it.

Dueline sends nothing and the assessment is yours. The same arithmetic runs in the free deadline calculator, in your browser. More in How deadlines are counted.

For another rule, see GDPR breach notification and the NIS2 early warning. Back to Dueline.