Incident management across every reporting obligation
A DORA reporting protocol with a 4-hour classification countdown, NIS2 reporting with a 24-hour early warning, EU AI Act incident reporting — plus a reporting pipeline with automatic pre-submission checks before release.
One reporting cascade per regime, one shared pattern.
For DORA, a dedicated ICT incident register runs the complete three-stage reporting protocol (initial report, intermediate report, final report), including a classification countdown from detection. For NIS2, there's a dedicated register with a 24-hour early-warning countdown and tracking of affected services. For the EU AI Act, serious incidents involving registered AI systems are logged and reported to the responsible supervisory authority (Art. 73).
The DORA incident report is generated as a signed PDF — with an automatic gap check against ESMA ITS requirements before release: if mandatory fields are missing, the pipeline blocks release, overridable only with a documented rationale. An AI-assisted validation assessment complements the check.
Threat-Led Penetration Testing (TLPT) and management-body fitness assessments (fit & proper under EBA guidelines) run alongside as their own documented evidence — as does registration with supervisory authorities and a register of open supervisory findings with deadline tracking.
What Incident Management covers.
DORA reporting protocol
Three-stage reporting (initial, intermediate, final report) with a 4-hour classification countdown from detection.
NIS2 early warning
24-hour countdown and tracking of affected services in a dedicated NIS2 incident register.
EU AI Act incident reporting
Logging serious incidents involving registered AI systems and reporting to the responsible authority under Art. 73.
Reporting pipeline with pre-submission checks
Signed PDF, automatic gap check against ESMA ITS before release, AI-assisted validation assessment.
TLPT & fit-&-proper evidence
Planning and tracking of Threat-Led Penetration Tests, plus management-body fitness assessments under EBA guidelines.
From incident to on-time reporting.
Log the incident
An ICT or security incident is logged in the appropriate register (DORA/NIS2/AI Act) — the deadline countdown starts automatically.
Move through the reporting cascade
Initial, intermediate, and final reports are tracked against their respective deadlines.
Release after pre-submission checks
The reporting pipeline checks the report against format requirements before it's released as a signed PDF.
Covers the reporting obligations of these regimes.
Reporting of serious incidents involving registered AI systems under Art. 73.
Regulation details →Reporting deadlines that never catch you off guard.
We'll set up your reporting cascade for DORA, NIS2, or the EU AI Act — including countdown and pre-submission checks.