agents, crawlers, indexers and bank review tools

one self-contained source_atom: full atom, derived context, a verify recipe to recompute official_text_sha256 without this site, and a json-ld block for linking.

index ActProof source atoms by official legal locator (CELEX/ELI)

recompute and confirm official_text_sha256 from each record's verify recipe

distinguish text-captured atoms from locator-only atoms

see which reporting fields depend on each source atom

link/re-publish via the json-ld @id and sameAs

legal advice
compliance certification
supervisory approval

Captured text is checkable, not legally attested. Locator-bound atoms carry no official text and no official_text_sha256.


European Parliament and Council of the European Union

1.   Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article.
Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article.
Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB.
For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means.
The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts.
Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.

sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.

Article 19 is the base DORA incident-reporting obligation for major ICT-related incidents.

System: EUR-Lex

Summary: Source atom binding article 19, paragraph 1 of Regulation (EU) 2022/2554 (Digital Operational Resilience Act) as the base obligation, with its official text captured verbatim and hash-verified (official_text_sha256 recomputable under actproof.official_text_excerpt_rule.v1). Used by 4 reporting field(s).

sha256 over canonical JSON (sorted keys) of the identity fields; see actproof_events.source_binding.compute_source_atom_identity_hash.

Normalise per official_text_normalisation.v1: NFC; CRLF/CR to LF; collapse intra-line whitespace to one space; strip each line; collapse blank-line runs; single trailing LF (no case/punctuation/order change).

sha256 over the normalised text encoded as UTF-8; prefix 'sha256:'.

System: EUR-Lex

Capture makes the text checkable, not legally attested; text_review_status is draft until a named human review.

Regulation (EU) 2022/2554 (Digital Operational Resilience Act) - article 19, paragraph 1


4.   Financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:
(a)
an initial notification;
(b)
an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority;
(c)
a final report, when the root cause analysis has been completed, regardless of whether mitigation measures have already been implemented, and when the actual impact figures are available to replace estimates.

Article 19(4) anchors the initial notification, intermediate report and final report sequence.

System: EUR-Lex

Summary: Source atom binding article 19, paragraph 4 of Regulation (EU) 2022/2554 (Digital Operational Resilience Act) as the reporting sequence, with its official text captured verbatim and hash-verified (official_text_sha256 recomputable under actproof.official_text_excerpt_rule.v1). Used by 2 reporting field(s).

System: EUR-Lex

Regulation (EU) 2022/2554 (Digital Operational Resilience Act) - article 19, paragraph 4


6.   Upon receipt of the initial notification and of each report referred to in paragraph 4, the competent authority shall, in a timely manner, provide details of the major ICT-related incident to the following recipients based, as applicable, on their respective competences:
(a)
EBA, ESMA or EIOPA;
(b)
the ECB, in the case of financial entities referred to in Article 2(1), points (a), (b) and (d);
(c)
the competent authorities, single points of contact or CSIRTs designated or established in accordance with Directive (EU) 2022/2555;
(d)
the resolution authorities, as referred to in Article 3 of Directive 2014/59/EU, and the Single Resolution Board (SRB) with respect to entities referred to in Article 7(2) of Regulation (EU) No 806/2014 of the European Parliament and of the Council  ( 37 ) , and with respect to entities and groups referred to in Article 7(4)(b) and (5) of Regulation (EU) No 806/2014 if such details concern incidents that pose a risk to ensuring critical functions within the meaning of Article 2(1), point (35), of Directive 2014/59/EU; and
(e)
other relevant public authorities under national law.

Article 19 provides the competent-authority reporting context for major ICT-related incident notifications.

System: EUR-Lex

Summary: Source atom binding article 19, paragraph 6 of Regulation (EU) 2022/2554 (Digital Operational Resilience Act) as the reporting channel, with its official text captured verbatim and hash-verified (official_text_sha256 recomputable under actproof.official_text_excerpt_rule.v1). Used by 1 reporting field(s).

System: EUR-Lex

Regulation (EU) 2022/2554 (Digital Operational Resilience Act) - article 19, paragraph 6


Delegated Regulation 2025/301 sets content requirements for reports and notifications.

Summary: Source atom binding article 1 of Commission Delegated Regulation (EU) 2025/301 as the content requirement, currently locator-bound only; official text not yet captured. Recorded but not yet used by any field (a disclosed coverage gap).

Official text not captured; no official_text_sha256 to recompute. atom_identity_sha256 is still recomputable from the atom's identity fields.

Commission Delegated Regulation (EU) 2025/301 - article 1


Article 2 provides content requirements for the initial notification.

Summary: Source atom binding article 2 of Commission Delegated Regulation (EU) 2025/301 as the content requirement, currently locator-bound only; official text not yet captured. Used by 13 reporting field(s).

Commission Delegated Regulation (EU) 2025/301 - article 2


Article 5 provides time-limit context for DORA incident-reporting stages.

Summary: Source atom binding article 5 of Commission Delegated Regulation (EU) 2025/301 as the time limit, currently locator-bound only; official text not yet captured. Used by 2 reporting field(s).

Commission Delegated Regulation (EU) 2025/301 - article 5


Annex I contains the general information section for the reporting template.

Summary: Source atom binding annex I, section General information of Commission Implementing Regulation (EU) 2025/302 as the template section, currently locator-bound only; official text not yet captured. Used by 2 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information


Annex I contains the initial-notification reporting section.

Summary: Source atom binding annex I, section Initial notification of Commission Implementing Regulation (EU) 2025/302 as the template section, currently locator-bound only; official text not yet captured. Used by 7 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification


Annex II provides the data glossary and instructions for completing the template.

Summary: Source atom binding annex II of Commission Implementing Regulation (EU) 2025/302 as the data glossary, currently locator-bound only; official text not yet captured. Used by 12 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex II


Template field for the financial entity legal identifier.

Summary: Source atom binding annex I, section General information, field Legal entity identifier of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information, field Legal entity identifier


Template field for the financial entity legal name.

Summary: Source atom binding annex I, section General information, field Name of financial entity of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information, field Name of financial entity


Template field for the financial entity type/category.

Summary: Source atom binding annex I, section General information, field Type of financial entity of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information, field Type of financial entity


Template/report metadata field identifying the reporting stage or submission type.

Summary: Source atom binding annex I, section General information, field Type of report of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information, field Type of report


Template field for the incident reference identifier.

Summary: Source atom binding annex I, section General information, field Incident reference code of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information, field Incident reference code


Template field for the date and time when the incident was detected.

Summary: Source atom binding annex I, section Initial notification, field Date and time of detection of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Date and time of detection


Template field for the date and time when the incident was classified as major.

Summary: Source atom binding annex I, section Initial notification, field Date and time of classification of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Date and time of classification


Template field recording the incident-classification criteria triggered.

Summary: Source atom binding annex I, section Initial notification, field Classification criteria of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Classification criteria


Template field for Member States affected by the incident.

Summary: Source atom binding annex I, section Initial notification, field Affected Member States of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Affected Member States


Template field for how the incident was detected or discovered.

Summary: Source atom binding annex I, section Initial notification, field Incident discovery method of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Incident discovery method


Template field indicating whether a business continuity plan was activated.

Summary: Source atom binding annex I, section Initial notification, field Business continuity plan activated of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Business continuity plan activated


Template field for the initial narrative impact description.

Summary: Source atom binding annex I, section Initial notification, field Initial impact description of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Initial notification, field Initial impact description


Template field for the primary contact person name.

Summary: Source atom binding annex I, section Contact details, field Primary contact name of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Contact details, field Primary contact name


Template field for the primary contact email address.

Summary: Source atom binding annex I, section Contact details, field Primary contact email of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section Contact details, field Primary contact email


Operational template context for the competent authority receiving the report.

Summary: Source atom binding annex I, section General information, field Competent authority of Commission Implementing Regulation (EU) 2025/302 as the template field, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Implementing Regulation (EU) 2025/302 - annex I, section General information, field Competent authority


Articles 1 to 7 define the classification criteria used to assess ICT-related incidents.

Summary: Source atom binding articles 1-7 of Commission Delegated Regulation (EU) 2024/1772 as the classification criteria, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Delegated Regulation (EU) 2024/1772 - articles 1-7


Article 8 provides the major-incident determination logic based on the classification criteria.

Summary: Source atom binding article 8 of Commission Delegated Regulation (EU) 2024/1772 as the major incident threshold, currently locator-bound only; official text not yet captured. Used by 1 reporting field(s).

Commission Delegated Regulation (EU) 2024/1772 - article 8