{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/14","url":"https://www.headlesslaw.com/dora/articles/14","title":"Article 14 — Communication","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"30cdb18abf03de90","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/14/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/14/versions/2022-12-27/rev/30cdb18abf03de90","versions_url":"https://www.headlesslaw.com/dora/articles/14/versions","relations_url":"https://www.headlesslaw.com/dora/articles/14/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"49edf74a8bd9f7f1db606b352e895ce36312674915a3385297c312bb752dc53d","markdown_sha256":"4d20642540fecedbfd433662dac7c36b7ab09d25fb70dc160836b8b083cd4153"},"units":[{"locator":"dora/art/14","kind":"article","status":"in_force","label":null,"heading":"Communication","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dora/art/14/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.","marks":[],"revision":1,"text_hash":"b1213d706141a893c363d9ca56492565555de92e326f5bc1869ce4c2fab22ba0","reason":null},{"locator":"dora/art/14/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.","marks":[],"revision":1,"text_hash":"7f1383380598d9ebf1ee18aefb5550eff4fab39e05df24e7967c1be3a6f3469c","reason":null},{"locator":"dora/art/14/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.","marks":[],"revision":1,"text_hash":"9eab3dafa40fbb262fd1b299c2be95c50ab2938a1b00562cfa464a80bed271b6","reason":null}],"markdown":"*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*\n\n1. <a id=\"p-1\"></a>As part of the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework referred to in [Article 6(1)](6.md), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) or [vulnerabilities](https://www.headlesslaw.com/definitions/dora/vulnerability) to clients and counterparts as well as to the public, as appropriate.\n2. <a id=\"p-2\"></a>As part of the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management, in particular the staff responsible for response and recovery, and staff that needs to be informed.\n3. <a id=\"p-3\"></a>At least one person in the financial entity shall be tasked with implementing the communication strategy for [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) and fulfil the public and media function for that purpose.\n\n***\n\n[Chapter II — ICT risk management](../chapters/ii.md) › Section II · [← Article 13](13.md) · [Article 15 →](15.md)\n"}