{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/10","url":"https://www.headlesslaw.com/dora/articles/10","title":"Article 10 — Detection","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"3fd2651d9aa78c16","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/10/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/10/versions/2022-12-27/rev/3fd2651d9aa78c16","versions_url":"https://www.headlesslaw.com/dora/articles/10/versions","relations_url":"https://www.headlesslaw.com/dora/articles/10/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"fa07c96bf653803282b97279024f5b2097a0dbcd62bca500200d1b234dbdc830","markdown_sha256":"8f3b137fdb4f9248c8334e15a787c5ff80a26207658014f7093d827e5ca6f342"},"units":[{"locator":"dora/art/10","kind":"article","status":"in_force","label":null,"heading":"Detection","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dora/art/10/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.","marks":[],"revision":1,"text_hash":"4955a5328247357e9209d8b0f0849e3e6c2ccf9556bf24644e1a019cb6e13481","reason":null},{"locator":"dora/art/10/para/1/cont/1","kind":"continuation","status":"in_force","label":null,"heading":null,"text":"All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with Article 25.","marks":[],"revision":1,"text_hash":"79f0e1c7332af60609c22d18b0198945fc9ce0268998f1940b385d27f3819748","reason":null},{"locator":"dora/art/10/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"The detection mechanisms referred to in paragraph 1 shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes, including automatic alert mechanisms for relevant staff in charge of ICT-related incident response.","marks":[],"revision":1,"text_hash":"3e47a66feb66dbe488c875b7c3d2b3b9594c3c29fb9e5e17d47d2bec3d8e4c32","reason":null},{"locator":"dora/art/10/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.","marks":[],"revision":1,"text_hash":"ff248de16b4a514f25c9463215ae96cc92c894977d1070bfe90b8be0fafeb6ba","reason":null},{"locator":"dora/art/10/para/4","kind":"paragraph","status":"in_force","label":"4.","heading":null,"text":"Data reporting service providers shall, in addition, have in place systems that can effectively check trade reports for completeness, identify omissions and obvious errors, and request re-transmission of those reports.","marks":[],"revision":1,"text_hash":"aff0b76513ff70a5eea0dba315c155dfa9fe525a32fb363876947994e2ec35f9","reason":null}],"markdown":"*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*\n\n1. <a id=\"p-1\"></a>Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with [Article 17](17.md), including ICT network performance issues and [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident), and to identify potential material single points of failure.\n\n    All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with [Article 25](25.md).\n2. <a id=\"p-2\"></a>The detection mechanisms referred to in paragraph 1 shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) response processes, including automatic alert mechanisms for relevant staff in charge of [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) response.\n3. <a id=\"p-3\"></a>Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident), in particular [cyber-attacks](https://www.headlesslaw.com/definitions/dora/cyber-attack).\n4. <a id=\"p-4\"></a>[Data reporting service providers](https://www.headlesslaw.com/definitions/dora/data-reporting-service-provider) shall, in addition, have in place systems that can effectively check trade reports for completeness, identify omissions and obvious errors, and request re-transmission of those reports.\n\n***\n\n[Chapter II — ICT risk management](../chapters/ii.md) › Section II · [← Article 9](9.md) · [Article 11 →](11.md)\n"}