Commission Delegated Regulation (EU) 2025/301
Article 5 · Major ICT-related incident reporting
Product · Regulatory intelligence and connected GRC
From regulatory change to accountable action.
NeoGRC reads the source, structures the obligation, identifies what materially changed, maps the organisational impact and prepares the next decision for accountable human review.
Book a focused demoAI identifies. Humans decide.REGULATORY UPDATEDORA Article 19
Review readyReporting windows require a controlled review of the notification process.
CTRL-IR-07POL-SEC-12RSK-ICT-04ACT-243
Seven-stage regulatory workflow
From authoritative source to controlled execution.
Follow a change through structure, comparison, materiality, connected impact, human review and operational work. Platform configuration, deployment and permanent history follow below.
Stage 01 · Source
Retain the official regulatory context.
NeoGRC records the source, version, publication context and article reference before any analysis begins.
Verified sourceOfficial Journal version
Published 20 February 2025 · source status verified
Representative source context
Initial, intermediate and final reporting duties are retained with their authoritative reference.
Verified regulatory material is distinguished from illustrative organisational records.
Stage 02 · Structure
Turn dense text into trackable duties.
Each duty keeps its applicability, responsible function and precise link back to the source paragraph.
3 obligationsSubmit initial notification
Applicable to major ICT incidents · Operational Resilience · Article 5(1)(a)
Submit intermediate report
Incident Management · Article 5(1)(b)
Submit final report
Compliance and ICT Risk · Article 5(1)(c)
Every obligation is individually reviewable and remains connected to its source.
Stage 03 · Compare
Separate operational change from moved wording.
Semantic comparison identifies additions, removals and modified requirements without treating editorial movement as substantive change.
Version awareDORA Article 19
Established the incident-reporting sequence and delegated detailed time limits.
Technical-standard detail
Introduces operational reporting windows for initial, intermediate and final reports.
Material operational change
Notification timers and escalation evidence require implementation review.
Formatting and numbering changes are retained as editorial movement, not escalated as operational work.
Stage 04 · Materiality
Explain why the difference matters.
The platform stages its reasoning, confidence and applicability for a responsible person to assess.
High · 92%Material · operational
The more specific reporting windows affect an existing notification process.
Applicable
The organisation operates an in-scope incident-reporting procedure.
Human decision required
Confirm the control timer, policy wording and evidence capture before execution.
AI identifies. Humans decide. Confidence never substitutes for accountable review.
Stage 05 · Impact
Reveal the affected control environment.
NeoGRC follows explicit relationships from the obligation to the records that implement, govern and evidence it.
6 recordsRegulatory incident notification timer
The configured timing logic must reflect the reviewed reporting windows.
ICT Incident Response Policy
The escalation and notification section requires controlled revision.
Late regulatory notification
Residual exposure changes if the timer or escalation route is incomplete.
EVD-019, the incident reporting system and accountable owners remain connected to the same review.
Stage 06 · Human review
Put the recommendation in accountable hands.
A named reviewer evaluates the proposed decision and records the rationale before anything can progress.
Awaiting SofiaSofia Laurent
Compliance Officer · assigned reviewer
Accept with controlled deployment
Update the policy draft and control timer, then retain implementation evidence.
Required field
The final decision and reviewer reasoning become permanent history.
Accept, request changes or reject. Nothing is silently published or applied.
Stage 07 · Execute
Create controlled downstream work.
The resulting tasks depend on the human outcome; operational records remain protected until the review permits action.
StagedControl update task opened
Martin Novak assigned · due date established
Policy draft created
POL-SEC-12 remains staged and is not automatically deployed.
Accountable owners notified
Review outcome and rationale accompany every assigned action.
A request for changes or rejection leaves existing operational records unchanged.
Regulatory comparison
See the wording. Understand the consequence.
DORA establishes the reporting sequence. The related technical standard makes the operational time limits specific.
Representative summary: initial notification, intermediate report and final report, with detailed time limits specified through the technical standards.
Representative summaryRepresentative summary: time-bound initial notification followed by an intermediate report and a final report within the prescribed reporting sequence.
Representative summaryThe reporting sequence now has implementable operational time limits.
POL-SEC-12 must state the escalation and notification windows.
CTRL-IR-07 must start, monitor and evidence the relevant timer.
EVD-019 must retain submission timestamps and authority receipts.
Source distinction: the cited regulation is verified regulatory material. NeoGRC IDs and organisational records are illustrative.
Official EUR-Lex sourceConnected operational impact
One change can touch the entire control environment.
A focused DORA Article 19 path shows how one obligation reaches the records, evidence and people responsible for implementation.
Major ICT incident reporting
→contains · Sofia Laurent · Live source
Submit initial notification
→changes exposure · Sofia Laurent · Review ready
Late regulatory notification
→mitigated by · Elena Fischer · Under review
Notification timer
→defined in · Martin Novak · Update proposed
ICT Incident Response Policy
→operates in · Elena Fischer · Draft staged
Incident reporting system
→produces · Martin Novak · Active
Authority submission receipt
→supports · Sofia Laurent · Required
Update reporting timers
→assigned to · Martin Novak · Staged
Martin Novak
accountable · Martin Novak · Assigned
Human accountabilityEF
MN
SL
The recommendation is automated. The decision is accountable.
AI output stays staged until a named reviewer acts. Approval, correction or rejection—and the rationale behind it—remain attributable.
Elena FischerHead of Operational Resilience
Martin NovakICT Risk Manager
Sofia LaurentCompliance Officer
HUMAN DECISION GATENothing advances without attribution.
- AI output is staged
- A named reviewer must act
- Reviewers can approve, modify or reject
- Rationale is retained
- Nothing is silently published
- Every decision is attributable
- Human corrections improve future recommendations
Decision outcomes
One recommendation. Three controlled outcomes.
Switch outcomes to see exactly what changes—and what remains protected—after the reviewer acts.
Accepted
Reviewed work is created, but deployment remains staged.
- Policy state
- Draft created
- Control state
- Update task opened
- Assigned action
- ACT-243 · due date established
- Owner notification
- Martin Novak notified
- Audit event
- Acceptance and rationale retained
- Deployment status
- Staged · further approval required
Changes requested
The recommendation returns to its owner without changing operational records.
- Policy state
- Existing version unchanged
- Control state
- Existing configuration unchanged
- Assigned action
- Returned to control owner
- Owner notification
- Requested changes and rationale sent
- Audit event
- Reviewer response retained
- Deployment status
- Blocked pending final review
Rejected
The recommendation closes while source analysis and reasoning remain available.
- Policy state
- No change
- Control state
- No change
- Assigned action
- Recommendation closed
- Owner notification
- Owners can see rejection rationale
- Audit event
- Rejection retained permanently
- Deployment status
- No deployment
08 · Platform configuration and governance
Configure how accountable work operates.
The workflow runs on a connected object model—not isolated forms. Configuration governs what teams record, who can decide, where a rule applies and how controlled changes reach production.
Regulations →DORAGDPRFuture libraryCapabilities ↓GRC coreRiskAudit
Regulations · Provisions · Obligations
Business units · Processes · Assets · Systems
Risks · Controls · Policies · Procedures · Evidence
Vendors · Contracts · Incidents · Audits · Actions
Owners · Approval authorities
Schema-driven forms
Govern fields, validation, relationships and evidence requirements as versioned configuration.
Custom workflows
Define review states, transitions, separation of duties and escalation without changing historical records.
Ownership and authority
Assign record owners and distinct approval authorities at the point where accountability is required.
Scoped operating models
Apply configuration by business unit, regulation and GRC capability while keeping operational data separated.
Role-based access
Limit actions by role and scope, including time-limited access for an external auditor.
Staged configuration
Validate configuration changes in draft before an authorised deployment can make them active.
Configuration inheritanceBASENeoGRC schemaCore definitions and governed defaults →CONSULTANTPractice configurationReusable expertise and client-safe templates →CLIENT / ENTERPRISEScoped overrideLocal forms, workflow and authority
Configure once. Override only where context differs.
09 · Versioned deployment
Change configuration without rewriting history.
Drafts remain isolated until validated and approved. Rollback creates a new version from a trusted state; it never deletes the deployment, decision or operational history that came before it.
10 · Permanent audit trail
Every suggestion and every decision remains attributable.
NeoGRC separates authoritative source history, operational compliance history, human decision history and configuration deployment history.
SRC-2025-301Regulatory source ingestedSystem
OBL-019AObligation extractedRegulatory intelligence
CMP-019-04Version comparedSystem
MAT-019-02Material change identifiedSystem
IMP-019-07Impact analysis completedSystem
REV-019-03Sofia Laurent opened reviewSofia Laurent
DEC-019-04Recommendation acceptedSofia Laurent
ACT-243Action assignedMartin Novak
EVD-019Decision evidence retainedSystem
Four distinct histories
Regulatory source
Original publication, version and authoritative reference
Compliance record
Obligation, risk, control, policy and evidence changes
Human decision
Reviewer, outcome, rationale and timestamp
Configuration deployment
Draft, approval and production deployment as separate events
Regulation-agnostic by design
Built once, extended across regulations.
Start with the regulation that matters today. Extend the same operating model as the library grows.
Focused product walkthrough
Book a focused demoBring your next regulatory change into focus.
Whether you advise clients or operate an enterprise control environment, review a real regulatory-change workflow with the NeoGRC team.