National authorities

Reporting to your own regulator

DORA is one regulation, but you file with your national competent authority, and each one runs its own channel. Pick your authority in your workspace settings and the incident countdowns, activity log and exports name that authority, its channel and its own guidance. Every statement below comes from the authority's published pages and carries a source link; where an authority does not publish something, we say so rather than guess.

None of these authorities publishes an open interface that lets software submit on your behalf, so the final upload is always yours to make. What we do is hand you a submission-ready file and the exact steps for your authority.

Central Bank of Ireland

Ireland · Financial entities authorised in Ireland that fall in scope of DORA (Regulation (EU) 2022/2554).

Major incident channel: Central Bank of Ireland Portal
Source: Guide to Submitting DORA Major ICT-related Incident and Significant Cyber Threat Reports on the Portal (January 2025)
Submission language: Not published by this authority
Register of information: Registers of Information are submitted through the Central Bank of Ireland Portal, following the Central Bank's register submission guide.
Source: Guide to Submitting DORA Registers of Information on the Portal (March 2025)

Reporting timetable

Initial notification
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it (Article 19 DORA, Commission Delegated Regulation (EU) 2025/301).
Intermediate report
Within 72 hours of the initial notification, and again whenever there is a relevant status change.
Final report
No later than one month after the most recent intermediate report, covering root cause and remediation.

Central Bank of Ireland — DORA Reporting Major ICT-related Incidents and Significant Cyber Threats under DORA Reporting Registers of Information

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Germany · Financial entities supervised in Germany that fall in scope of DORA.

Major incident channel: BaFin MVP Portal — reports are filed as a JSON or XML file upload, or automatically through the SOAP web service
Source: Anleitung für die Übermittlung von IKT-bezogenen Vorfallsmeldungen (Dateiupload / SOAP-Webservice)
Submission language: Not published by this authority
Register of information: Not published by this authority

Reporting timetable

Initial notification
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it (Article 19 DORA, Commission Delegated Regulation (EU) 2025/301).
Intermediate report
Within 72 hours of the initial notification, and again whenever there is a relevant status change.
Final report
No later than one month after the most recent intermediate report, covering root cause and remediation.

BaFin — Meldung schwerwiegender IKT-bezogener Vorfälle BaFin DORA FAQ — submission of reports on major ICT-related incidents BaFin — Management, classification and reporting of ICT-related incidents BaFin — Anleitung Übermittlung von DORA-Meldungen via Dateiupload und SOAP

Autorité de contrôle prudentiel et de résolution (ACPR)

France · Financial entities supervised in France that fall in scope of DORA.

Major incident channel: Reports follow the ACPR's JSON incident template (maquette d'incident DORA); the ACPR publishes its DORA reporting arrangements on e-surfi and its DORA pages
Source: Comment remplir la maquette d'incident DORA (août 2025)
Submission language: French — the ACPR publishes its DORA reporting guidance in French.
Register of information: Not published by this authority

Reporting timetable

Initial notification
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it (Article 19 DORA, Commission Delegated Regulation (EU) 2025/301).
Intermediate report
Within 72 hours of the initial notification, and again whenever there is a relevant status change.
Final report
No later than one month after the most recent intermediate report, covering root cause and remediation.

ACPR — Digital Operational Resilience Act (DORA)FAQ sur la directive et le règlement DORA ACPR — DORA ACPR — Comment remplir la maquette d'incident DORA

De Nederlandsche Bank (DNB)

Netherlands · Financial institutions supervised in the Netherlands that fall in scope of DORA.

Major incident channel: Not published by this authority
Submission language: Not published by this authority
Register of information: DNB collects the register of information annually; its published sector notice sets out the reporting window and the arrangements for that year.
Source: DNB — Reporting DORA registers of information in March 2026

Reporting timetable

Initial notification
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it (Article 19 DORA, Commission Delegated Regulation (EU) 2025/301).
Intermediate report
Within 72 hours of the initial notification, and again whenever there is a relevant status change.
Final report
No later than one month after the most recent intermediate report, covering root cause and remediation.

DNB — DORA DNB — DORA (open book supervision)DNB — Reporting DORA registers of information in March 2026

Included in every plan — see pricing. Authority pages change; if you spot something out of date, tell us and we will correct it.