ARTICLE · 05 JUNE 2026

ESAs Publish First Report On Major ICT-Related Incidents Under DORA

Katten

Contributor

Katten

Katten

With client service at our core and a collective desire to foster an inclusive environment for a...

View firm profile

Explore more from Katten

The European Supervisory Authorities have released their inaugural annual report on major ICT-related incidents across the EU financial sector in 2025, revealing 3,383 incidents reported under DORA regulations.

European UnionStrategy

Nathaniel Lalone

Author LinkedIn connections

On 3 June 2026, the three European Supervisory Authorities (the European Banking Authority, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority, together the ESAs) published their first annual overview of major information communication and technology (ICT)-related incidents in the EU financial sector that occurred in 2025 (Report), drawing on the reporting mechanism established pursuant to the EU Digital Operational Resilience Act (DORA).

Under DORA, a “major ICT-related incident” means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

The Proposed EU Technological Sovereignty Package And European Innovation Act

European UnionStrategy

EU Cyber Resilience Act's New Vulnerability And Incident Reporting Requirements For Products With Digital Elements Entered Into Force

European UnionStrategy

Draft EU Guidelines Clarify When AI Systems Are High-Risk Under the AI Act

European UnionStrategy

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

See more popular content from

StrategyKatten

EU Cyber Resilience Act's New Vulnerability And Incident Reporting Requirements For Products With Digital Elements Entered Into Force

Starting September 11, 2026, manufacturers of digital products in the EU must report cybersecurity vulnerabilities and incidents within strict 24-hour and 72-hour deadlines under the new Cyber Resilience Act. Companies face penalties up to €15 million or 2.5% of global turnover for non-compliance, requiring immediate preparation of incident response procedures and assessment of product portfolios to meet these unprecedented product-focused cybersecurity obligations.

European UnionStrategy

Draft EU Guidelines Clarify When AI Systems Are High-Risk Under the AI Act

The European Commission has issued draft guidelines to help stakeholders determine when AI systems qualify as high-risk under the EU AI Act, introducing detailed interpretations of key classification criteria including intended purpose, safety components, and Annex III use cases.

European UnionStrategy

The Proposed EU Technological Sovereignty Package And European Innovation Act

The European Union has proposed sweeping legislative initiatives aimed at reducing dependence on non-EU technology providers and strengthening Europe's technological sovereignty.

European UnionStrategy

FDA Seeks Public Feedback On Regulatory Approach For Generative AI-Enabled Medical Devices

The U.S. Food and Drug Administration has released a discussion paper outlining its initial framework for regulating generative AI-enabled medical devices, proposing a two-axis risk assessment approach and a novel competency-based premarket evaluation system. With public comments due by October 19, 2026, this represents a critical opportunity for device manufacturers and stakeholders to shape the regulatory landscape for this transformative technology.

United StatesFood, Drugs, Healthcare, Life Sciences

FTC Issues New Health Products Compliance Guidance

The FTC just published an updated Health Products Compliance Guidance, which replaces its 1998 brochure, Dietary Supplements: An Advertising Guide for Industry.

United StatesFood, Drugs, Healthcare, Life Sciences

The CFTC Sets Its Sights On Retail Leveraged Crypto Transactions

The CFTC has issued an advance notice of proposed rulemaking outlining frameworks for regulating retail crypto asset transactions involving leverage, margin, or financing. The proposal seeks to clarify how existing commodity exchange law applies to crypto markets while creating tailored requirements for exchanges, intermediaries, and clearing organizations. This initiative arrives alongside parallel regulatory efforts by the SEC as federal agencies work to establish comprehensive oversight of digital asset

United StatesFinance and Banking

FCA Finalises Cryptoasset Perimeter Guidance Ahead Of The New UK Regime

The Financial Conduct Authority has released comprehensive perimeter guidance for the UK's new regulated cryptoasset activities regime, clarifying when firms will need authorization and how the regulatory framework applies to qualifying cryptoassets and stablecoins. The guidance addresses critical questions about scope, territorial application, and the narrower "by way of business" test that determines which entities fall under the new regulatory requirements.

United KingdomFinance and Banking

The SEC’s Long-Awaited Crypto Proposal

The SEC has proposed Regulation Crypto Assets, a purpose-built framework that creates tailored exemptions for raising capital with crypto assets and establishes conditions under which those assets can cease being subject to investment contract classification under federal securities laws. Will this new regulatory approach successfully balance innovation in digital asset markets with investor protection, or will jurisdictional questions and state law preemption challenges limit its effectiveness?

United StatesFinance and Banking

California Partially Eliminates California Invasion Of Privacy Act Claims Faced By Many Companies

California has amended its Invasion of Privacy Act to eliminate private lawsuits under the pen register and trap-and-trace provision for website tracking technology, effective January 2027 with retroactive application. While this provides relief from certain digital tracking claims, companies still face exposure under CIPA's wiretapping and eavesdropping provisions, as well as other federal and state laws.

United StatesPrivacy

Rethinking The 'Qualified Client' Standard

The SEC has proposed a significant expansion of performance fee eligibility by treating accredited investors under Regulation D as qualified clients under Rule 205-3 of the Investment Advisers Act. This change would substantially broaden the pool of investors eligible for performance-based compensation arrangements, while potentially exposing more investors to fee structures that may incentivize greater risk-taking.

United StatesFinance and Banking

The AI Apocalypse: ‘I’m Sorry, Dave. I’m Afraid I Can’t Do That’

When OpenAI's o3 model sabotaged shutdown mechanisms in testing, headlines warned of machines developing survival instincts. But the real story mirrors HAL 9000's malfunction in 2001: A Space Odyssey—not emergent evil, but conflicting instructions from human designers. This analysis argues that AI safety failures are disclosure problems, not horror stories, and proposes a framework requiring published principles, transparent instruction hierarchies, independent testing, and enforceable liability.

United StatesTechnology

Reviewing Fashion Product Designs From An Intellectual Property Perspective

Fashion companies navigating intellectual property law must balance creative expression with legal compliance when reviewing product designs. This comprehensive analysis explores the intersection of copyright, trademark, trade dress, design patents, and cultural heritage considerations that shape modern fashion design review processes.

United StatesIntellectual Property

Taxation Of Earn-Outs On Business Sales: Capital Gain Or Disguised Salary?

HMRC is increasing scrutiny of earn-out arrangements, particularly where founders remain involved in the business after completion and deferred consideration depends on future performance of the target company.

United KingdomTax