{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2025/301 — RTS — Major ICT Incident Reporting [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3","url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3","title":"Article 3 — Specific information to be provided in intermediate reports","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","view_of":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","valid_from":"2025-03-12","valid_until":null,"content_id":"2ed6f96318467887","versions":["2025-03-12"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3/versions/2026-10-26/rev/2ed6f96318467887","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting#art-3","source_line":"Commission Delegated Regulation (EU) 2025/301 · binding · OJ L, 2025/301, 20.2.2025 · dated 23 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-23","published_on":"2025-02-20","entry_into_force":"2025-03-12","locators":{"document_date":"CELLAR 32025R0301 work_date_document","published_on":"CELLAR 32025R0301 official-journal-act_date_publication","entry_into_force":"CELLAR 32025R0301 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","name":"Commission Delegated Regulation (EU) 2025/301","number":"2025/301","celex":"32025R0301","title_official":"COMMISSION DELEGATED REGULATION (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats (Text with EEA relevance)","document_date":"2024-10-23"},"position":{"kind":"article","key":"3","index":3,"articles":7,"annexes":0},"prev":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/2","key":"2","title":"Article 2 — Specific information to be provided in initial notifications"},"next":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4","key":"4","title":"Article 4 — Article Specific information to be provided in final reports"},"act_anchor":"#art-3"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting.md","unit_text_sha256":"701ba65d87f1c7d5c4381a1333ce6d48f5e91a7fc48b59c70bb5f9c98b1b7b2b","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting/art-3","kind":"article","key":"3","heading":"Article 3 — Specific information to be provided in intermediate reports","text":"## <a id=\"art-3\"></a>Article 3 — Specific information to be provided in intermediate reports\n\nIntermediate reports as referred to in [Article 19(4)](../../articles/19.md), point (b), of Regulation (EU) 2022/2554 shall contain at least all of the following specific information:\\\n   <a id=\"art-3-p-a\"></a>a) where applicable, the incident reference code provided by the competent authority;\\\n   <a id=\"art-3-p-b\"></a>b) the date and time of occurrence of the ICT-related incident;\\\n   <a id=\"art-3-p-c\"></a>c) where applicable, the date and time when the financial entity has recovered its regular activities;\\\n   <a id=\"art-3-p-d\"></a>d) information about how the criteria laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772 have been fulfilled, on the basis of which the financial entity classified the ITC-related incident as major;\\\n   <a id=\"art-3-p-e\"></a>e) the type of ICT-related incident;\\\n   <a id=\"art-3-p-f\"></a>f) where applicable, the threats and techniques used by the threat actor;\\\n   <a id=\"art-3-p-g\"></a>g) affected functional areas and business processes;\\\n   <a id=\"art-3-p-h\"></a>h) affected infrastructure components supporting business processes;\\\n   <a id=\"art-3-p-i\"></a>i) impact on the financial interest of clients;\\\n   <a id=\"art-3-p-j\"></a>j) information about reporting about the ICT-related incident to other authorities;\\\n   <a id=\"art-3-p-k\"></a>k) temporary actions or measures taken or planned to be taken by the financial entity to recover from the ICT-related incident;\\\n   <a id=\"art-3-p-l\"></a>l) where applicable, information on indicators of compromise.\\\n\n","marks":[],"text_hash":"701ba65d87f1c7d5c4381a1333ce6d48f5e91a7fc48b59c70bb5f9c98b1b7b2b","revision":1}}