Artikel 2 Särskild information som ska lämnas i en första anmälan

This article specifies the minimum content requirements for the initial notification that financial entities must submit when a major ICT-related incident occurs.

It builds directly on the general information requirements established in Article 1, adding the incident-specific detail that competent authorities need at the earliest stage of reporting.

The article covers the essential facts of the incident — what happened, when it was detected, why it was classified as major, where it has impact, and how it was discovered — while also touching on response actions already taken.

Important points:

• Include the classification criteria from Delegated Regulation (EU) 2024/1772 that justify designating the incident as major — this is a mandatory element of the initial notification.
• State whether a business continuity plan has been activated, as this is a required disclosure from the outset.
• Where applicable, report any reclassification of the incident from major to non-major as part of this initial notification.