ToolsDORA incident clock
When is each DORA report due?
Enter when you became aware of a major ICT-related incident and when you classified it. The clock gives the initial, intermediate and final report deadlines, in your time zone, with the article behind each one.
Clock
Times below are entered and shown in this zone. Use the zone of the Member State you report in.
When you classified it as a major ICT-related incident.
Credit institutions, central counterparties, operators of trading venues and entities that are essential or important under NIS2 do not get weekend relief for the initial and intermediate reports (Article 5(5)).
Optional. Dates in your Member State, as YYYY-MM-DD separated by commas. Weekends are counted automatically.
Optional. The intermediate report runs from the actual submission.
Optional. The final report runs from the latest one.
Enter when you became aware of the incident.
Deadlines are counted from the exact times you enter, which gives the earliest deadline. How periods are counted in your case is for your supervisor or counsel to decide.
Not legal advice. This tool applies the arithmetic of the text to the times you enter. Your competent authority, national law and your own classification decide what applies to you.
Method
What the regulation says.
Initial
4 hours from classification, at most 24 hours from awareness
Article 5(1)(a): as early as possible, within four hours from classifying the incident as major and no later than 24 hours from becoming aware of it. Article 5(2): if you classify it as major only after those 24 hours, the four hours run from classification.
Intermediate
72 hours from submitting the initial notification
Article 5(1)(b): at the latest within 72 hours from the submission of the initial notification, even if nothing has changed. Send an updated intermediate report without undue delay when the status changes, and in any case once regular activities are recovered.
Final
One month after the latest intermediate report
Article 5(1)(c): no later than one month after the intermediate report or, where there are updates, the latest updated intermediate report. The clock adds one calendar month at the same local time (31 January becomes 28 or 29 February).
Weekends
Noon of the next working day, for most entities
Article 5(4): a limit that falls on a weekend day or a bank holiday in your Member State may be met by noon of the next working day. Article 5(5): this does not apply to the initial notification or intermediate report of credit institutions, central counterparties, operators of trading venues, or entities that are essential or important under NIS2. Article 5(6): competent authorities can also disapply it for significant or systemic entities they notify.
Late
Tell the authority before the limit passes
Article 5(3): if you cannot submit in time, inform the competent authority without undue delay, and no later than the limit, and explain why.
Arithmetic
Elapsed hours, local calendar days
Hours are elapsed time: 24 hours across a daylight saving change is 23 or 25 hours on the wall clock. Weekends, bank holidays, noon and months are read in the time zone you choose. Times are stored in the link as ISO 8601 with their offset, plus the zone.
Counting
Counted from the exact times you enter
Deadlines are counted from the exact times you enter, which gives the earliest deadline. How periods are counted in your case is for your supervisor or counsel to decide.
Sources
Read the text.
DORA
Commission Delegated Regulation (EU) 2025/301, Article 5
OJ L, 20.2.2025Regulatory technical standards on the content and time limits for the initial notification of, and intermediate and final reports on, major ICT-related incidents, supplementing Regulation (EU) 2022/2554. Text checked on EUR-Lex on 15 October 2026.
EUR-Lex: Delegated Regulation (EU) 2025/301NIS2
Directive (EU) 2022/2555, Article 23(4)
OJ L 333, 27.12.2022Early warning within 24 hours and incident notification within 72 hours of becoming aware of a significant incident (24 hours for trust service providers), and a final report not later than one month after the incident notification. National transposing law sets the exact rules. Text checked on EUR-Lex on 15 October 2026.
EUR-Lex: Directive (EU) 2022/2555Not legal advice
A calculator, not counsel
The clock shows the arithmetic of the published text for the times you enter. Whether an incident is major, which Member State's holidays apply and whether your authority has disapplied the weekend relief are for you, your counsel and your competent authority.
Read next