The change nobody put in a headline
On 3 June 2026 the European supervisors published the first DORA incident report. Everyone focused on the 3,383 incidents. Almost nobody noticed the quieter news that came with it.
The ESAs opened a call for input on the future of DORA incident reporting. They want to hear from the industry on how the framework should work in the years ahead. The deadline is 3 July 2026.
This is your chance to shape where incident reporting goes next. And it points at one big idea that has been sitting in the background since day one. A single EU hub.
- The ESAs want input on the future of DORA incident reporting by 3 July 2026
- They will publish a roadmap by the end of the year
- Specific rule changes are expected to be consulted on in 2027
- The headline idea is a single EU hub for incident reports
- None of this changes what you must do today
Why the ESAs are rethinking incident reporting
Year one showed the cracks.
Reports came in through different national channels, in different formats, sometimes in different languages. The supervisors had to clean and translate a lot of it before they could even count it. Around 15% of incidents were missing a final report at the cutoff.
That is not a criticism of any one firm. It is what happens when 27 countries run their own front doors to the same regulation. The ESAs want to close that gap. The call for input is the first formal step.
The three models on the table
This is not a new question. DORA itself, in Article 21, told the ESAs to study whether incident reporting should be more centralised. Their feasibility study set out three options.
- The baseline. What we have now. You report to your national authority, which passes information up the chain.
- Enhanced data sharing. The national channels stay, but data flows between authorities far more smoothly behind the scenes.
- A single EU hub. One front door for the whole Union. You report once, in one format, to one place.
The study found all three are workable. The hub is the most ambitious, and the slowest to build. The enhanced sharing model could arrive within a few years. A full hub would take several years after that.
So if you are picturing a single EU portal by next year, adjust your timeline. This is a direction, not a date.
What a single EU hub would mean for you
Picture the good version. One template. One channel. One deadline clock. No more checking which national portal wants which field in which format. For a firm that operates across several member states, that is real relief.
Now the catch. A shared hub only works if everyone feeds it clean, structured data. That raises the bar. The sloppy submissions that slipped through in year one will not survive a system built on automatic validation. The move to a hub and the push for better data quality are the same push.
What does not change
Read this part twice, because it is the part people get wrong.
Nothing about your obligations today has changed. The four hour clock still runs from the moment you classify an incident as major. The 72 hour intermediate report still applies. The final report is still due within a month. You still report through your national authority.
The call for input is about the future. Your reporting duties are about right now. Do not let one distract you from the other.
How to prepare for whatever comes
You cannot control which model the EU picks. You can control how ready you are for any of them.
- Get your incident data clean and structured now. A hub will demand it, and good data helps you today anyway.
- Standardise how you capture timestamps. Detection, classification, escalation, notification, recovery. Keep them separate and accurate.
- Stop treating the final report as paperwork. Build it into the incident process from the first hour.
- Map which national channels you report through today. If you operate in several countries, know each one.
- Watch for the roadmap at the end of 2026. That is when the direction gets real.
Should you respond to the call for input?
If you have a view on how incident reporting should work, yes. This is the moment supervisors are actually asking. Industry bodies will respond, but individual firms and providers can too. The deadline is 3 July 2026, so there is not much time.
Even if you do not respond, read what comes back. The responses will shape the roadmap, and the roadmap will shape your next few years of reporting.
How DORA GRC helps
The firms that will cope best with any future model are the ones whose reporting is already structured, not scattered.
DORA GRC runs your incident process on the current ITS templates, holds the timeline and evidence in one place, and keeps the data clean enough to move into whatever channel the EU lands on. When the rules shift, you adjust a template, not your whole process. Try the free assessment to see how ready your incident process is today.Frequently asked questions
What is the DORA call for input on incident reporting?
It is a request from the European supervisors for industry views on how the DORA incident reporting framework should develop. It was opened alongside the first incident report and closes on 3 July 2026.
When is the deadline?
3 July 2026. After that, the ESAs plan to publish a roadmap by the end of the year, with specific rule changes expected to be consulted on in 2027.
What is the single EU hub?
It is a proposed single entry point for major incident reports across the whole EU. Instead of reporting through your national authority, you would report once to one shared system. It is one of three models under review and would take several years to build.
Does this change my current DORA reporting obligations?
No. The four hour, 72 hour and one month deadlines still apply, and you still report through your national competent authority. The call for input is about the future, not the present.