{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2025/301 — RTS — Major ICT Incident Reporting [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/6","url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/6","title":"Article 6 — Content of the voluntary notification of significant cyber threats","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","view_of":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","valid_from":"2025-03-12","valid_until":null,"content_id":"e1ae0e29c42818ff","versions":["2025-03-12"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/6/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/6/versions/2026-10-26/rev/e1ae0e29c42818ff","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/6/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/6/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-301-major-ict-incident-reporting#art-6","source_line":"Commission Delegated Regulation (EU) 2025/301 · binding · OJ L, 2025/301, 20.2.2025 · dated 23 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-23","published_on":"2025-02-20","entry_into_force":"2025-03-12","locators":{"document_date":"CELLAR 32025R0301 work_date_document","published_on":"CELLAR 32025R0301 official-journal-act_date_publication","entry_into_force":"CELLAR 32025R0301 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting","path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting","name":"Commission Delegated Regulation (EU) 2025/301","number":"2025/301","celex":"32025R0301","title_official":"COMMISSION DELEGATED REGULATION (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats (Text with EEA relevance)","document_date":"2024-10-23"},"position":{"kind":"article","key":"6","index":6,"articles":7,"annexes":0},"prev":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/5","key":"5","title":"Article 5 — Time limits for the initial notification, and for the intermediate and final reports"},"next":{"path":"/dora/level-2/rts/2025-301-major-ict-incident-reporting/articles/7","key":"7","title":"Article 7 — Entry into force"},"act_anchor":"#art-6"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting.md","unit_text_sha256":"d1e5b11a834185a7f14eb77c67d0bba3bbc3620ac7d1ca9e6b51774ea1c2d4d6","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2025-301-major-ict-incident-reporting/art-6","kind":"article","key":"6","heading":"Article 6 — Content of the voluntary notification of significant cyber threats","text":"## <a id=\"art-6\"></a>Article 6 — Content of the voluntary notification of significant cyber threats\n\nThe content of the voluntary notification in relation to significant cyber threats as referred to in [Article 19(2)](../../articles/19.md) of Regulation (EU) 2022/2554 shall cover all of the following:\\\n   <a id=\"art-6-p-a\"></a>a) general information about the notifying financial entity as set out in Article 1;\\\n   <a id=\"art-6-p-b\"></a>b) the date and time of detection of the significant cyber threat and any other relevant timestamps related to the significant cyber threat;\\\n   <a id=\"art-6-p-c\"></a>c) a description of the significant cyber threat;\\\n   <a id=\"art-6-p-d\"></a>d) information about the potential impact of the significant cyber threat on the financial entity, its clients, or financial counterparts;\\\n   <a id=\"art-6-p-e\"></a>e) the classification criteria that would have triggered a major incident report laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772 if the cyber threat had materialised;\\\n   <a id=\"art-6-p-f\"></a>f) information about the status of the significant cyber threat and any changes in the threat activity;\\\n   <a id=\"art-6-p-g\"></a>g) where applicable, a description of the actions taken by the financial entity to prevent the materialisation of the significant cyber threats;\\\n   <a id=\"art-6-p-h\"></a>h) information about any notification of the significant cyber threat to other financial entities or authorities;\\\n   <a id=\"art-6-p-i\"></a>i) where applicable, information on indicators of compromise;\\\n   <a id=\"art-6-p-j\"></a>j) where available, any other relevant information.\\\n\n","marks":[],"text_hash":"d1e5b11a834185a7f14eb77c67d0bba3bbc3620ac7d1ca9e6b51774ea1c2d4d6","revision":1}}