Artikel 8 Allvarliga incidenter

This is a pivotal classification article that defines exactly when an incident crosses the threshold to become a "major incident" triggering the reporting obligations under Article 19(1) of DORA.

It draws directly on the criteria and materiality thresholds established in Articles 6 and 9, acting as the decision-making gateway that ties those detailed criteria together.

Notably, the article also addresses a more nuanced scenario: repeated smaller incidents that do not individually qualify as major can be aggregated and treated as a single major incident if certain conditions are met, closing a potential loophole.

Important points:

• Ensure you classify an incident as major where it affects critical services and either meets the specific data-loss/unauthorised-access threshold or meets two or more of the other materiality thresholds from Article 9.
• Assess recurring incidents on a monthly basis, as incidents sharing the same root cause and occurring at least twice within 6 months may collectively constitute one major incident.
• The recurring incidents aggregation rule does not apply to microenterprises or financial entities listed in Article 16(1) of Regulation (EU) 2022/2554.