<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2025/301 — RTS — Major ICT Incident Reporting [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4","url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4","title":"Article 4 — Article Specific information to be provided in final reports","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","view_of":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","valid_from":"2025-03-12","valid_until":null,"content_id":"58183318b12cb8a0","versions":["2025-03-12"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4/versions/2026-10-26/rev/58183318b12cb8a0","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/4/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting#art-4","source_line":"Commission Delegated Regulation (EU) 2025/301 · binding · OJ L, 2025/301, 20.2.2025 · dated 23 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-23","published_on":"2025-02-20","entry_into_force":"2025-03-12","locators":{"document_date":"CELLAR 32025R0301 work_date_document","published_on":"CELLAR 32025R0301 official-journal-act_date_publication","entry_into_force":"CELLAR 32025R0301 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","name":"Commission Delegated Regulation (EU) 2025/301","number":"2025/301","celex":"32025R0301","title_official":"COMMISSION DELEGATED REGULATION (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats (Text with EEA relevance)","document_date":"2024-10-23"},"position":{"kind":"article","key":"4","index":4,"articles":7,"annexes":0},"prev":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/3","key":"3","title":"Article 3 — Specific information to be provided in intermediate reports"},"next":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/5","key":"5","title":"Article 5 — Time limits for the initial notification, and for the intermediate and final reports"},"act_anchor":"#art-4"}}} -->
# Article 4 — Article Specific information to be provided in final reports

**Commission Delegated Regulation (EU) 2025/301 · binding · OJ L, 2025/301, 20.2.2025 · dated 23 Oct 2024 [in force]**

*In force · Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng)*

Final reports as referred to in [Article 19(4)](../../articles/19.md), point (c), of Regulation (EU) 2022/2554 shall contain all of the following specific information:\
   <a id="art-4-p-a"></a>a) information about the root causes of the ICT-related incident;\
   <a id="art-4-p-b"></a>b) dates and times when the ICT-related incident was resolved and the root cause(s) addressed;\
   <a id="art-4-p-c"></a>c) information on the resolution of the ICT-related incident;\
   <a id="art-4-p-d"></a>d) where applicable, information relevant for resolution authorities;\
   <a id="art-4-p-e"></a>e) information about direct and indirect costs and losses stemming from the ICT-related incident and information about financial recoveries;\
   <a id="art-4-p-f"></a>f) where applicable, information about recurring ICT-related incidents.\
