Art.18 Classification of ICT-related incidents and cyber threats

Financial entities classify ICT-related incidents and assess their impact using: how many clients or financial counterparts are affected or how relevant they are, transaction value or count where relevant, and any reputational impact; the length of the incident and of any service downtime; geographical spread, particularly where more than two Member States are affected; data losses affecting availability, authenticity, integrity or confidentiality; criticality of the services affected; and direct and indirect economic impact in absolute and relative terms. Significant cyber threats are classified by the criticality of services at risk, the clients or counterparts targeted and geographical spread. Thresholds are set by Commission Delegated Regulation (EU) 2024/1772: an incident is major when it has affected critical services and either involves a successful malicious intrusion into its network and information systems (Art. 9(5)(b)) or meets at least two other materiality thresholds (Art. 8(1)); the rule that aggregates recurring incidents into one major incident (Art. 8(2)) does not apply to microenterprises or to Article 16(1) entities.

Source: DORA (Regulation (EU) 2022/2554), Art.18. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.