ESAs Issue Operational Instructions to Improve DORA Major ICT Incident Reporting Quality

Key Takeaways

• On September 16, 2026, the ESAs published 14 operational instructions to harmonize how major ICT-related incidents are reported under DORA and to fix recurring data quality issues.
• The instructions are non-binding "best efforts" guidance, but they were agreed with competent authorities and signal supervisory expectations.
• Compliance teams should align reporting templates and procedures now to avoid rejected, inconsistent, or duplicated submissions.

Deep Dive

On September 16, 2026, the ESAs published 14 operational instructions to harmonize how major ICT-related incidents are reported under DORA and to fix recurring data quality issues. The instructions are non-binding "best efforts" guidance, but they were agreed with competent authorities and signal supervisory expectations. Compliance teams should align reporting templates and procedures now to avoid rejected, inconsistent, or duplicated submissions.

Several instructions address data formatting. Monetary fields (3.11, 4.13, 4.14) must be reported in thousands of units, for example EUR 2,500 reported as 3 (or 2,5), and in the currency stated in Field 1.15. Free-text fields should contain only relevant content, and entries such as "not applicable" or "none" should be avoided, with non-mandatory fields left blank. This applies specifically to Fields 4.10 and 4.11 (resolution authority information), which should be completed only where the incident poses a risk to critical functions or has affected resolvability. Field 2.8 (third-party provider or other financial entity origin) should follow a semicolon-delimited format: legal name; LEI or EUID code; code type; additional information. Free text may remain in the national language, but headers and closed-question values are expected to follow the English ITS terminology at the authority-to-ESAs stage.

Other instructions address lifecycle and classification logic. Fields 1.3a, 1.3b, and 2.1 must remain unchanged from initial notification through final report, because changes can cause double counting. Corrections must be submitted as a new version of the latest report type and must include all information from the latest update. Since the final report is due no later than one month after the latest intermediate report, at least one intermediate report per month is expected until the final report is filed. Field 2.5 must always explicitly list "critical services affected" alongside at least one other criterion. Field 2.6 (geographical spread) must exclude the entity's home country. Field 3.17 (actual versus estimated duration and downtime) must be completed in both intermediate and final reports. Field 3.25 should use the "excluding identity theft" wording for data exfiltration and manipulation. Field 4.12 (economic impact thresholds) is always required in final reports where economic impact is a Field 2.5 criterion, and it may be reported voluntarily otherwise. Firms may also consult EBA Q&A 2025_7439 on staff costs.

Recommended actions: (1) gap-assess incident report templates, tooling, and validation rules against all 14 items; (2) add automated checks for monetary scaling, locked identifier fields, blank-versus-"N/A" handling, and the Field 2.8 format; (3) set up a monthly intermediate reporting cadence in incident playbooks to prevent missing final reports; (4) update correction workflows and train incident managers, third-party risk teams, and resolution planning staff; (5) confirm with national competent authorities whether local portals apply these instructions or differ. No compliance deadline is set, but the guidance is effective immediately and will be revised over time.

Risk implications: Non-adherence is unlikely to be a direct violation, given the guidance's non-binding status. It still creates supervisory friction, resubmission burden, and data integrity issues such as duplicate incident counts, misclassified incidents, and late or missing final reports. Missed timelines and inaccurate classification carry the greatest exposure under DORA. Inaccurate reports could also undermine broader operational resilience and third-party risk oversight.

Source: European Securities and Markets Authority