{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/21","url":"https://www.headlesslaw.com/dora/articles/21","title":"Article 21 — Centralisation of reporting of major ICT-related incidents","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"31dd76175bd71d19","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/21/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/21/versions/2022-12-27/rev/31dd76175bd71d19","versions_url":"https://www.headlesslaw.com/dora/articles/21/versions","relations_url":"https://www.headlesslaw.com/dora/articles/21/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"b40250988d6c3a691c618c4a8fe0880a9b7792fb06b13c89c6c89d21f54d30af","markdown_sha256":"346cb9638b585b817c2aa8815d02053f559b7d8e9fc13138eff41a6bfd274f4f"},"units":[{"locator":"dora/art/21","kind":"article","status":"in_force","label":null,"heading":"Centralisation of reporting of major ICT-related incidents","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dora/art/21/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"The ESAs, through the Joint Committee, and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further centralisation of incident reporting through the establishment of a single EU Hub for major ICT-related incident reporting by financial entities. The joint report shall explore ways to facilitate the flow of ICT-related incident reporting, reduce associated costs and underpin thematic analyses with a view to enhancing supervisory convergence.","marks":[],"revision":1,"text_hash":"a479dae144775157f793b525730d8f7e3c107dcca7e9f92e5307b3420a5d2f93","reason":null},{"locator":"dora/art/21/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"The joint report referred to in paragraph 1 shall comprise at least the following elements:","marks":[],"revision":1,"text_hash":"72dda70ed9cf3f24369d9ac104822f28d0386c80b035bd52ba4aac1c2ce06489","reason":null},{"locator":"dora/art/21/para/2/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"prerequisites for the establishment of a single EU Hub;","marks":[],"revision":1,"text_hash":"58e531f04b9a2e47092483c67c641df124ebc6c38298b69a947810063d152f5a","reason":null},{"locator":"dora/art/21/para/2/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"benefits, limitations and risks, including risks associated with the high concentration of sensitive information;","marks":[],"revision":1,"text_hash":"2ec3d95debabd4117ae3171c3831b37d56b9ea509491a49b2f488dfe7713e855","reason":null},{"locator":"dora/art/21/para/2/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"the necessary capability to ensure interoperability with regard to other relevant reporting schemes;","marks":[],"revision":1,"text_hash":"9651a6bb98b4609f27363dbb1ee8a1d0c2715fb74e6305e57566fecc6241cab3","reason":null},{"locator":"dora/art/21/para/2/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"elements of operational management;","marks":[],"revision":1,"text_hash":"6f056f08de280bbaa6bdb504d4d54310a94c9d67cbaef22f956d7178cfd1a65d","reason":null},{"locator":"dora/art/21/para/2/pt/e","kind":"point","status":"in_force","label":"(e)","heading":null,"text":"conditions of membership;","marks":[],"revision":1,"text_hash":"dbe6a4c3952d3447c9406cd2d7074c06e304e35fc2addb4ebb5df63db4d5f307","reason":null},{"locator":"dora/art/21/para/2/pt/f","kind":"point","status":"in_force","label":"(f)","heading":null,"text":"technical arrangements for financial entities and national competent authorities to access the single EU Hub;","marks":[],"revision":1,"text_hash":"fa147e2fd2d386bc25afe4eca1d59e52281f3f7e0441764c70d273a330cc6c87","reason":null},{"locator":"dora/art/21/para/2/pt/g","kind":"point","status":"in_force","label":"(g)","heading":null,"text":"a preliminary assessment of financial costs incurred by setting-up the operational platform supporting the single EU Hub, including the requisite expertise.","marks":[],"revision":1,"text_hash":"50411d5c86b6305b7ce2bb91d36ef0dbf3a5229e41696e79bac1bb7187dc021e","reason":null},{"locator":"dora/art/21/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"The ESAs shall submit the report referred to in paragraph 1 to the European Parliament, to the Council and to the Commission by 17 January 2025.","marks":[],"revision":1,"text_hash":"dad214bc912a6d82f0d8dd7b9ce63c27d9d9ed097a1c161294a07d5a9be8cf02","reason":null}],"markdown":"*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*\n\n1. <a id=\"p-1\"></a>The ESAs, through the [Joint Committee](https://www.headlesslaw.com/definitions/dora/joint-committee), and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further centralisation of incident reporting through the establishment of a single EU Hub for [major ICT-related incident](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) reporting by financial entities. The joint report shall explore ways to facilitate the flow of [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) reporting, reduce associated costs and underpin thematic analyses with a view to enhancing supervisory convergence.\n2. <a id=\"p-2\"></a>The joint report referred to in paragraph 1 shall comprise at least the following elements:\n\n    <a id=\"p-2-a\"></a>**(a)** prerequisites for the establishment of a single EU Hub;\n\n    <a id=\"p-2-b\"></a>**(b)** benefits, limitations and risks, including risks associated with the high concentration of sensitive information;\n\n    <a id=\"p-2-c\"></a>**(c)** the necessary capability to ensure interoperability with regard to other relevant reporting schemes;\n\n    <a id=\"p-2-d\"></a>**(d)** elements of operational management;\n\n    <a id=\"p-2-e\"></a>**(e)** conditions of membership;\n\n    <a id=\"p-2-f\"></a>**(f)** technical arrangements for financial entities and national competent authorities to access the single EU Hub;\n\n    <a id=\"p-2-g\"></a>**(g)** a preliminary assessment of financial costs incurred by setting-up the operational platform supporting the single EU Hub, including the requisite expertise.\n3. <a id=\"p-3\"></a>The ESAs shall submit the report referred to in paragraph 1 to the European Parliament, to the Council and to the Commission by 17 January 2025.\n\n***\n\n[Chapter III — ICT-related incident management, classification and reporting](../chapters/iii.md) · [← Article 20](20.md) · [Article 22 →](22.md)\n"}