Submit initial notification
Article 5(1)(a)As early as possible; within four hours of major classification and no later than 24 hours after awareness.
Interactive product demoReview the change.
Review the change.
Trace the impact.
Work through a real DORA reporting requirement, then explore the illustrative organisational records connected to it. Source text is clearly separated from demo data.
01 Select each review stage 02 Inspect the decision record03 Explore the graph
Illustrative workspace shown with representative product data. People, organisations and operational records are fictional.
LIVE REVIEW DEMO · DORA ARTICLE 19Major ICT incident reporting
Review readyOfficial sourceOpen EUR-Lex ↗
Commission Delegated Regulation (EU) 2025/301
“within four hours from the classification … and no later than 24 hours”
4hfrom major classification24hfrom awareness72hintermediate report1 monthfinal report
Verified regulatory text. Organisational records in this demo are illustrative.
Structured obligations
3 extractedThree reporting duties, retained with source context
Submit intermediate report
Article 5(1)(b)Within 72 hours of the initial notification, including where incident handling has not changed.
Submit final report
Article 5(1)(c)No later than one month after the intermediate or latest updated intermediate report.
Semantic comparison
Material detailDORA set the sequence. The technical standard makes it operational.
Initial notification, intermediate report and final report; time limits to be specified under Article 20.
4h / 24h initial deadline, 72h intermediate deadline and one-month final deadline.
Materiality assessment
96% confidenceOperational deadline introduced—not editorial movement
Incident procedures need explicit timers, escalation points and evidence of submission.
Triggered after the incident is classified as major under DORA.
Align policy, control design, playbook and evidence retention to the new deadlines.
Connected impact
6 objectsConcrete records affected by the reporting timetable
Starts at awareness, records classification time and escalates before the 4h / 24h boundary.
Pending reviewSection 6.4 must state the initial, intermediate and final reporting deadlines.
Pending reviewResidual risk requires reassessment after the timer and escalation control is updated.
Pending reviewRetain competent-authority receipt, submission timestamp and approved report version.
Pending review
EFElena FischerHead of Operational Resilience · accountable owner
MNMartin NovakICT Risk Manager · control owner
SLSofia LaurentCompliance Officer · reviewer
SLYOU ARE REVIEWING ASSofia Laurent · Compliance Officer
Recommended verdict
Approve a controlled update to policy and incident reporting controls.
- Add explicit 4h / 24h / 72h / one-month timers to the playbook.
- Configure escalation to Operational Resilience and Compliance.
- Retain submission receipts and approved report versions as evidence.
Nothing is published until you decide.
✓
WORKFLOW RESULTDecision recorded
JUST NOW · SOFIA LAURENTHuman review opened
Audit trailThe recommendation remains staged and attributable.
Review complete
Now follow the obligation into the operating model.
The graph below is interactive. Filter by regulation, select records, zoom and trace the downstream path.
Connected GRC
Visualise your entire GRC structure.
Move beyond isolated registers. Explore how regulations, obligations, risks, controls, policies, evidence, actions and accountable people connect across the organisation.
DORA + GDPR: both regulatory structures are highlighted. Clear either filter to fade its exclusive records.
NIS2 · Coming soonEU AI Act · Coming soonMiCA · Coming soonCSRD/CSDDD · Coming soon
Drag nodes · scroll to zoom · drag the canvas to pan · select any node for details
Every relationship is navigable, attributable and ready for evidence—not another flat register to reconcile manually.
What the completed review shows
A decision that remains connected to its source and consequences.
The demonstration uses representative data to make the resulting records visible. It does not publish a regulatory conclusion until the visitor records a human decision.
What NeoGRC identified
A material reporting-timetable change and the obligations and records that may be affected.
What the human decided
Whether to accept, return or reject the prepared recommendation, with attributable rationale.
What operational records changed
Policy and control work is staged or left unchanged according to the recorded decision.
What stayed in history
The source, comparison, recommendation, reviewer, rationale and downstream outcome remain reviewable.
Bring a regulatory change your team is assessing.
Request a focused session NeoGRC will prepare one relevant workflow using representative data.