§ DORA · Article 18

DORA Article 18: Obligations, Deadlines & Penalties

Regulation (EU) 2022/2554, Article 18 · All obligations · DORA

At a glance

Article 18 of the DORA imposes 5 obligations on Commission, ESAs, Financial entities. At least one obligation carries an explicit compliance deadline.

§ Obligations

All obligations under Article 18

Obligation 1

Financial entities shall classify ICT-related incidents and determine their impact based on criteria including client impact, duration, geographical spread, data losses, service criticality, and economic impact. Regulation (EU) 2022/2554, Article 18, Article 18

Obligated entity: Financial entities
Sector scope: Financial sector
Action required: classify
Deadline: —
Penalty: —

Obligation 2

Financial entities shall classify cyber threats as significant based on the criticality of services at risk, number and relevance of clients targeted, and geographical spread. Regulation (EU) 2022/2554, Article 18, Article 18

Obligated entity: Financial entities
Sector scope: Financial sector
Action required: classify
Deadline: —
Penalty: —

Obligation 3

The ESAs shall develop common draft regulatory technical standards further specifying criteria for classifying ICT-related incidents, assessing relevance for cross-border sharing, and determining significant cyber threats. Regulation (EU) 2022/2554, Article 18, Article 18

Obligated entity: ESAs
Action required: develop
Deadline: —
Penalty: —

Obligation 4

The ESAs shall submit the common draft regulatory technical standards to the Commission by 17 January 2024. Regulation (EU) 2022/2554, Article 18, Article 18

Obligated entity: ESAs
Action required: submit
Deadline: 17 January 2024
Penalty: —

Obligation 5

The Commission shall adopt the regulatory technical standards referred to in paragraph 3 in accordance with the specified regulations. Regulation (EU) 2022/2554, Article 18, Article 18

Obligated entity: Commission
Action required: adopt
Deadline: —
Penalty: —

§ Frequently asked

Questions about Article 18

Who must comply with Article 18 of the DORA? +

Commission, ESAs, Financial entities.

What does Article 18 of the DORA require? +

classify develop submit

What is the compliance deadline for DORA Article 18? +

17 January 2024

Need a cross-border briefing on DORA Article 18?

Search Fontvera ↵

All EU obligation pages · All DORA articles