DORA· Article 19
Text
Article 19 DORA as printed in the Council text of 22 October 2026
Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
Source Council, 22 October 2026. Article 19: ST 14756/26, page 167 · exact text page
Scope This text prints Article 19(1), first subparagraph, Article 19(2), first subparagraph only.
Article 19(1), first subparagraph
Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 with the support of the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 in accordance with paragraph 4 of this Article.
Article 19(2), first subparagraph
Financial entities may, on a voluntary basis, notify with the support of the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.
How each paragraph has changed
| What each text would do to the law in force | ||||||||
|---|---|---|---|---|---|---|---|---|
| Paragraph | Commission19 Nov 2025 | Council21 May 2026 | Council10 Jun 2026 | Council18 Jun 2026 | Council3 Sep 2026 | Council2 Oct 2026 | Council22 Oct 2026 | Parliamentamendments |
| Compared with | law in force | the proposal | 21 May text | 10 Jun text | 18 Jun text | 3 Sep text | 2 Oct text | |
| 1Paragraph 1first subparagraph | Amends Changed | Amends , changed since the proposal Changed | Amends Unchanged | Amends Unchanged | Amends , changed since 18 Jun Changed | Amends Unchanged | Amends Unchanged | 5 |
| 2Paragraph 2first subparagraph | Amends Changed | Amends , changed since the proposal Changed | Amends Unchanged | Amends Unchanged | Amends , changed since 18 Jun Changed | Amends Unchanged | Amends Unchanged | 5 |
| Provisions only Parliament would add or change1 unit | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 1 |
Each text against the law in force: ~Amends amends the law in force— neither the law in force nor the text has it changed from the text before
Each text against the text before it: ~Changed wording changed=Unchanged same as the text before— in neither text
What each text does
- 19 Nov 2025 Commission proposalCOM(2025) 837 Amends Amends paragraphs 1 and 2. Article 19 in this text
- 21 May 2026 Council textST 9547/26 Changed Changes paragraphs 1 and 2.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 19 in this text
- 10 Jun 2026 Council textST 10426/26 Unchanged Same as the text before. Article 19 in this text
- 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 19 in this text
- 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 3 amendments to this article. Amendments in this document
- 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 2 amendments to this article. Amendments in this document
- 27 Jul 2026 ITRE–LIBE amendments 1741–1840 to the draft reportCJ72-AM-791883 4 amendments to this article. Amendments in this document
- 3 Sep 2026 Council textST 12535/26 Changed Changes paragraphs 1 and 2. Article 19 in this text
- 2 Oct 2026 Council textST 13886/26 Unchanged Same as the text before. Article 19 in this text
- 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 19 in this text
Paragraph 1
Changed by the Commission · changed by the Council on 21 May · changed on 3 September
Parliament amendments 5
2 would delete the first subparagraph and 3 propose alternative wording. Deletion amendments come from PfE and ESN.
| Type | EPP | ECR | PfE | ESN |
|---|---|---|---|---|
| − Deletion | · | · | 1 | 1 |
| ~ Alternative | 1 | 1 | 2 | · |
By political group
- − Deletion PfE 1 ESN 1
- ~ Alternative EPP 1 ECR 1 PfE 2
Show
288 −Deletion Ton Diepeveen +1PfE · JURI Deletes the first subparagraph
Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.
Article 8 Amendments to Regulation (EU) 2022/2554 Article 19 of Regulation (EU) 2022/2554 is amended as follows: 1. in paragraph 1, the first subparagraph is replaced by the following: ‘Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 in accordance with paragraph 4 of this Article. ‘Financial entities may, on a voluntary basis, notify via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.Justification
DORA has been implemented in 2025. Supervisory competent authorities are not yet operational. It would be too early to amend it now.
- Tabled by
- Ton Diepeveen, Pascale Piera
- Group
- PfE
- Targets
- DORA Article 8
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 8 / Regulation 2022/2554 / Article 8
289 ~Alternative Daniel BudaEPP · JURI “channel designated by the relevant competent authority or, where applicable, through the interoperable European framework”
‘Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 via the
single-entryreportingpointchannel designated by the relevant competent authority or, where applicable, through the interoperable European framework established pursuant to Article 23a of Directive (EU) 2022/2555, to the extent that such use does not affect the powers of the relevant competent authority, in accordance with paragraph 4 of this Article.’- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- DORA Article 19(1), first subparagraph
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 170
- Printed header
- Article 8 – paragraph 1 – point 1 / Regulation (EU) 2022/2554 / Article 19 – paragraph 1
521 ~Alternative Virginie JoronPfE · IMCO “Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 via the national single…”
Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 via the
single-entrynationalpointsingle points of entry established pursuant to Article 23a of Directive (EU) 2022/2555 in accordance with paragraph 4 of this Article.;- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- DORA Article 19(1), first subparagraph
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 8 – paragraph 1 – point 1 / Regulation (EU) 2022/2554 / Article 19 – paragraph 1
1815 −Deletion Markus BuchheitESN · ITRE–LIBE Deletes the first subparagraph
Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.
Article 8 Amendments to Regulation (EU) 2022/2554 Article 19 of Regulation (EU) 2022/2554 is amended as follows: 1. in paragraph 1, the first subparagraph is replaced by the following: ‘Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 in accordance with paragraph 4 of this Article. ‘Financial entities may, on a voluntary basis, notify via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.- Tabled by
- Markus Buchheit
- Group
- ESN
- Targets
- DORA Article 19
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 8 / Regulation (EU) 2022/2554 / Article 19
1816 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “national single-entry points to the EU”
Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46
viaby the national single-entry points to the EU single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 in accordance with paragraph 4 of this Article.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- DORA Article 19(1), first subparagraph
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 8 – paragraph 1 – point 1 / Regulation (EU) 2022/2554 / Article 19 – paragraph 1 – first subparagraph
Paragraph 2
Changed by the Commission · changed by the Council on 21 May · changed on 3 September
Parliament amendments 5
2 would delete the first subparagraph and 3 propose alternative wording. Deletion amendments come from PfE and ESN.
| Type | EPP | ECR | PfE | ESN |
|---|---|---|---|---|
| − Deletion | · | · | 1 | 1 |
| ~ Alternative | 1 | 1 | 2 | · |
By political group
- − Deletion PfE 1 ESN 1
- ~ Alternative EPP 1 ECR 1 PfE 2
Show
288 −Deletion Ton Diepeveen +1PfE · JURI Deletes the first subparagraph
Text and details of Amendment 288 under paragraph 1
290 ~Alternative Daniel BudaEPP · JURI “channel designated by the relevant competent authority or, where applicable, through the interoperable European framework”
‘Financial entities may, on a voluntary basis, notify via the
single-entryreportingpointchannel designated by the relevant competent authority or, where applicable, through the interoperable European framework established pursuant to Article 23a of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- DORA Article 19(2), first subparagraph
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 8 – paragraph 1 – point 2 / Regulation (EU) 2022/2554 / Article 19 – paragraph 2
522 ~Alternative Virginie JoronPfE · IMCO “Financial entities may, on a voluntary basis, notify via the national single points of entry established pursuant to Article 23a of Directive (EU)…”
Financial entities may, on a voluntary basis, notify via the
single-entrynationalpointsingle points of entry established pursuant to Article 23a of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.’p- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- DORA Article 19(2), first subparagraph
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 119
- Printed header
- Article 8 – paragraph 1 – point 2 / Regulation (EU) 2022/2554 / Article 19 – paragraph 2
1815 −Deletion Markus BuchheitESN · ITRE–LIBE Deletes the first subparagraph
Text and details of Amendment 1815 under paragraph 1
1817 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “national single-entry points to the EU”
Financial entities may, on a voluntary basis, notify
viaby the national single-entry points to the EU single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- DORA Article 19(2), first subparagraph
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Source
- Official text, page 47
- Printed header
- Article 8 – paragraph 1 – point 2 / Regulation (EU) 2022/2554 / Article 19 – paragraph 2 – first subparagraph
Provisions only Parliament amendments would add or change
1 amendment on 1 unit the Commission proposal leaves unchanged
Paragraph 8a (new)New
1818 +Addition Michael McNamara +5Renew · ITRE–LIBE “The Commission shall adopt delegated acts that lay down the specifications of a European template for reporting obligations under the single-entry…”
2a. In Article 19, paragraph 8a is added:
The Commission shall adopt delegated acts that lay down the specifications of a European template for reporting obligations under the single-entry point. Those delegated acts may harmonize reporting timelines, deadlines, thesholds and other data points in under this Act with those of other Union Acts. Those delegated acts shall be adopted in accordance with the examination procedure referred to in Article 57.'
- Tabled by
- Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Bart Groothuis, Veronika Cifrová Ostrihoňová
- Group
- Renew
- Targets
- DORA Article 19 – paragraph 8a (new)
- Document
- ITRE–LIBE amendments 1741–1840 to the draft report
- Printed header
- Article 8 – paragraph 1 – point 2 a (new) / Regulation (EU) 2022/2554 / Article 19 – paragraph 8a (new)