{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2024/1772 — RTS — ICT Incident Classification [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1772-ict-incident-classification/articles/7","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1772-ict-incident-classification/articles/7","title":"Article 7 — Economic impact","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1772-ict-incident-classification","view_of":"/dora/level-2/rts/2024-1772-ict-incident-classification","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2024/1772, OJ L, 2024/1772, 25.6.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2024/1772/oj/eng","valid_from":"2024-07-15","valid_until":null,"content_id":"81caf7b6796be586","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1772-ict-incident-classification/articles/7/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1772-ict-incident-classification/articles/7/versions/2026-10-26/rev/81caf7b6796be586","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1772-ict-incident-classification/articles/7/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1772-ict-incident-classification/articles/7/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1772-ict-incident-classification#art-7","source_line":"Commission Delegated Regulation (EU) 2024/1772 · binding · OJ L, 2024/1772, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1772 work_date_document","published_on":"CELLAR 32024R1772 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1772 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1772-ict-incident-classification","path":"/dora/level-2/rts/2024-1772-ict-incident-classification","name":"Commission Delegated Regulation (EU) 2024/1772","number":"2024/1772","celex":"32024R1772","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"7","index":7,"articles":13,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1772-ict-incident-classification/articles/6","key":"6","title":"Article 6 — Criticality of services affected"},"next":{"path":"/dora/level-2/rts/2024-1772-ict-incident-classification/articles/8","key":"8","title":"Article 8 — Major incidents"},"act_anchor":"#art-7"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2024/1772/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2024-1772-ict-incident-classification.md","unit_text_sha256":"e602c154267979ea5565a8750333764048df4f43fa4c850b5eb0eb9beacf8eec","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2024-1772-ict-incident-classification/art-7","kind":"article","key":"7","heading":"Article 7 — Economic impact","text":"## <a id=\"art-7\"></a>Article 7 — Economic impact\n\n1. <a id=\"art-7-p-1\"></a>For the purpose of determining the economic impact of the incident as referred to in [Article 18(1)](../../articles/18.md), point (f), of Regulation (EU) 2022/2554, financial entities shall, without accounting for financial recoveries, take into account the following types of direct and indirect costs and losses which they have incurred as a result of the incident:\\\n   <a id=\"art-7-p-1-a\"></a>a) expropriated funds or financial assets for which they are liable, including assets lost to theft;\\\n   <a id=\"art-7-p-1-b\"></a>b) costs for replacement or relocation of software, hardware or infrastructure;\\\n   <a id=\"art-7-p-1-c\"></a>c) staff costs, including costs associated with replacement or relocation of staff, recruitment of extra staff, remuneration of overtime and recovery of lost or impaired skills;\\\n   <a id=\"art-7-p-1-d\"></a>d) fees due to non-compliance with contractual obligations;\\\n   <a id=\"art-7-p-1-e\"></a>e) costs for redress and compensation to customers;\\\n   <a id=\"art-7-p-1-f\"></a>f) losses due to forgone revenues;\\\n   <a id=\"art-7-p-1-g\"></a>g) costs associated with internal and external communication;\\\n   <a id=\"art-7-p-1-h\"></a>h) advisory costs, including costs associated with legal counselling, forensic services and remediation services.\\\n2. <a id=\"art-7-p-2\"></a>Costs and losses referred to in paragraph 1 shall not include costs that are necessary for the day-to-day operation of the business, in particular the following:\\\n   <a id=\"art-7-p-2-a\"></a>a) costs for general maintenance of infrastructure, equipment, hardware and software, and costs for keeping skills of staff up to date;\\\n   <a id=\"art-7-p-2-b\"></a>b) internal or external costs to enhance the business after the incident, including upgrades, improvements and risk assessment initiatives;\\\n   <a id=\"art-7-p-2-c\"></a>c) insurance premiums.\\\n3. <a id=\"art-7-p-3\"></a>Financial entities shall calculate the amounts of costs and losses based on data available at the time of reporting. Where the actual amounts of costs and losses cannot be determined, financial entities shall estimate those amounts.\n4. <a id=\"art-7-p-4\"></a>When assessing the economic impact of the incident, financial entities shall sum up the costs and losses referred to in paragraph 1.\n\n**CHAPTER II — MAJOR INCIDENTS AND MATERIALITY THRESHOLDS**\n\n","marks":[],"text_hash":"e602c154267979ea5565a8750333764048df4f43fa4c850b5eb0eb9beacf8eec","revision":1}}