AI Governance Engineer
GitHub

Major ICT-related incident (DORA)

By Updated

Under the EU Digital Operational Resilience Act, an ICT-related incident at a financial entity that meets the classification criteria for a major incident. It is reported within 4 hours of classification and no later than 24 hours from awareness (within 4 hours of a classification made after those 24 hours), then in intermediate and final reports 1.

Developed in
ch. 17, The overlapping clocks
Chapters
ch. 17, Incidents
Source
1 numbered reference, listed below

Where it is used

3 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Major ICT-related incident (DORA): mentions per chapter5 mentions of the term across 3 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter08 Regulatory Map: 1 mention08 Regulatory Map117 Incidents: 2 mentions17 Incidents221 AI Laws Worldwide: 2 mentions21 AI Laws Worldwide2No mentions in the other 20 chaptersSource: the Body of Knowledgev0.5.0
Major ICT-related incident (DORA): mentions per chapter5 mentions of the term across 3 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter000102030405060708 Regulatory Map: 1 mention1081011121314151617 Incidents: 2 mentions21718192021 AI Laws Worldwide: 2 mentions2212223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of Major ICT-related incident (DORA) per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition0No
02 Why Now0No
03 Values & Principles0No
04 The Stack0No
05 Patterns0No
06 The Role0No
07 Maturity Model0No
08 Regulatory Map1No
10 Reading List0No
11 AI Defined0No
12 Governance Program0No
13 Risk Management0No
14 Development0No
15 Deployment0No
16 Fairness & XAI0No
17 Incidents2Yes
18 EU AI Act0No
19 Privacy & AI0No
20 Existing Law0No
21 AI Laws Worldwide2No
22 Principles & Standards0No
23 AI Agents0No
  • Reporting clock

    A statutory deadline for an incident notification, defined by its trigger (awareness, classification, causal link or determination), recipient, content and…

Sources

  1. [1] Commission Delegated Regulation (EU) 2025/301 (Art. 5, time limits for major ICT-related incident reports under DORA; Art. 5(2) late classification). Publications Office of the EU (EUR-Lex). 2024-10-23. https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Major ICT-related incident (DORA). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/major-ict-related-incident-dora. CC BY 4.0

BibTeX

@misc{aige2026majorictrelatedincidentdora,
  author  = {Jorge García Aibar},
  title   = {{Major ICT-related incident (DORA)}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/major-ict-related-incident-dora}
}