{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2025/301 — RTS — Major ICT Incident Reporting [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2","url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2","title":"Article 2 — Specific information to be provided in initial notifications","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","view_of":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","valid_from":"2025-03-12","valid_until":null,"content_id":"e37dcb610d66669b","versions":["2025-03-12"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2/versions/2026-10-26/rev/e37dcb610d66669b","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting#art-2","source_line":"Commission Delegated Regulation (EU) 2025/301 · binding · OJ L, 2025/301, 20.2.2025 · dated 23 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-23","published_on":"2025-02-20","entry_into_force":"2025-03-12","locators":{"document_date":"CELLAR 32025R0301 work_date_document","published_on":"CELLAR 32025R0301 official-journal-act_date_publication","entry_into_force":"CELLAR 32025R0301 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","name":"Commission Delegated Regulation (EU) 2025/301","number":"2025/301","celex":"32025R0301","title_official":"COMMISSION DELEGATED REGULATION (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats (Text with EEA relevance)","document_date":"2024-10-23"},"position":{"kind":"article","key":"2","index":2,"articles":7,"annexes":0},"prev":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/1","key":"1","title":"Article 1 — General information to be provided in initial notifications and intermediate and final reports on major ICT-related incidents"},"next":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3","key":"3","title":"Article 3 — Specific information to be provided in intermediate reports"},"act_anchor":"#art-2"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting.md","unit_text_sha256":"5b807aa5ed0fad4592620ceb6b7a7c0c5193bba656320d5df9421039c7c0226b","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting/art-2","kind":"article","key":"2","heading":"Article 2 — Specific information to be provided in initial notifications","text":"## Article 2 — Specific information to be provided in initial notifications\n\nInitial notifications as referred to in [Article 19(4)](../../articles/19.md), point (a), of Regulation (EU) 2022/2554 shall contain at least all of the following specific information:\\\n a) the incident reference code assigned by the financial entity;\\\n b) the date of detection, time of detection, and classification of the incident pursuant to Article 8 of Commission Delegated Regulation (EU) 2024/1772;\\\n c) a description of the ICT-related incident;\\\n d) the criteria, laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772, on the basis of which the financial entity classified the ICT-related incident as major;\\\n e) the Members States that are impacted by the ICT-related incident;\\\n f) information on how the ICT-related incident was discovered;\\\n g) where available, information about the origin of the ICT-related incident;\\\n h) information about whether the financial entity has activated a business continuity plan;\\\n i) where applicable, information about the reclassification of the ICT-related incident from major to non-major;\\\n j) where available, any other relevant information.\\\n\n","marks":[],"text_hash":"5b807aa5ed0fad4592620ceb6b7a7c0c5193bba656320d5df9421039c7c0226b","revision":1}}