DORA Incident Reporting and the EU Digital Omnibus

Q: What is the Single-Entry Point (SEP) the Digital Omnibus proposes?

The Single-Entry Point (SEP) is a single reporting portal, developed and operated by ENISA, that would let an organisation submit one incident notification and have it routed to every authority with a claim to it under NIS2, the CER Directive, eIDAS, GDPR, and DORA, instead of filing separately under each regime.

Q: How is the SEP different from the single EU Hub DORA's Article 21 already studied?

DORA's Article 21 required the EBA, ESMA, and EIOPA to study a finance-sector-only hub run by the supervisors themselves, and they reported on it in January 2025. The Single-Entry Point the Commission has now proposed is broader and differently owned: a cross-regime portal run by ENISA, covering entities under NIS2 and the CER Directive alongside DORA-regulated financial entities.

Q: When would the Single-Entry Point actually be available?

Not soon. The Digital Omnibus proposal is still subject to negotiation between the European Parliament and the Council, and even once adopted, it gives ENISA up to 18 months to make the Single-Entry Point operational, extendable to 24 months if the Commission finds it is not yet ready.

Q: Should financial entities change how they report incidents while this proposal is pending?

No. Financial entities should keep reporting major incidents through their existing channel under the current DORA rules. The most useful preparation is mapping where the same incident currently triggers separate filings under NIS2, CER, or GDPR, so the potential benefit of a shared reporting channel is already understood.

The European Commission's Digital Omnibus package, presented on 19 November 2025, proposes folding DORA's major-incident notifications into a shared EU-wide reporting channel built by ENISA, alongside NIS2, the CER Directive, eIDAS, and GDPR. Nothing has changed yet: the proposal is still working through the European Parliament and Council, and DORA's existing Article 19 reporting flow stays in force until it is adopted.

What the Commission actually proposed

The Digital Omnibus is a simplification package, not a DORA-specific reform. It responds to a broader EU push, reaffirmed in the European Council's conclusions of 23 October 2025, to cut administrative burden across the bloc's digital rulebook. Its centrepiece for incident reporting is a Single-Entry Point (SEP): one portal, developed and operated by ENISA, the EU's cybersecurity agency, built on top of the reporting infrastructure already under construction for the Cyber Resilience Act. According to the European Parliament's own research service, the SEP is designed to let an organisation submit one incident notification that is then routed to every authority with a legal claim to it, instead of filing separately under each regime.

That "report once, share many" model is meant to cover NIS2, the Critical Entities Resilience Directive, eIDAS, GDPR, and DORA's own incident-reporting pillar. For a bank, payment institution, or insurer that already reports major ICT incidents under DORA and may also carry NIS2 or GDPR notification duties for the same event, the pitch is one submission instead of two or three parallel ones to different authorities using different forms.

Why this looks familiar: DORA already asked the question

Financial entities have seen a version of this idea before. Article 21 of DORA required the European Supervisory Authorities, the EBA, ESMA, and EIOPA, to report by 17 January 2025 on whether further centralising major-incident reporting was feasible through a single EU Hub for the financial sector. The ESAs delivered that report on schedule. It examined three models, a baseline approach, an enhanced data-sharing arrangement, and a fully centralised hub, and concluded that all three were technically feasible, with a phased rollout in which a data-sharing solution could arrive within roughly three years and a fully centralised hub around five years after that.

What the Digital Omnibus proposes is not simply that plan going ahead. The Article 21 study modelled a finance-sector hub run by the ESAs, the supervisors financial entities already answer to. The SEP the Commission has now put forward is broader and differently owned: a cross-regime portal run by ENISA, a cybersecurity agency rather than a financial supervisor, serving NIS2 and CER-regulated entities across every critical sector at the same time as DORA-regulated ones. It is a related idea with a different architecture, not the direct implementation of the ESAs' own recommendation.

What stays the same for now

Nothing in DORA's substantive incident-reporting rules changes while this proposal is still a proposal. The Article 18 criteria for classifying an ICT-related incident as major are unchanged. The three-stage reporting flow set out in Article 19, an initial notification, an intermediate report, and a final report, is unchanged, and the templates and deadlines set through the existing regulatory and implementing technical standards remain what financial entities must follow today. Our incident classifier and guide to incident reporting for fintechs both describe the rules as they currently stand, and neither needs to change on account of a proposal that has not been adopted.

What the SEP would change, if adopted as described, is the channel: where and how a notification gets filed, and how many separate filings one incident requires, rather than the underlying question of whether an incident is reportable or how quickly.

Where the proposal stands in the legislative process

The Digital Omnibus follows the EU's ordinary legislative procedure. The Commission's proposal is a starting text, not a final one: the European Parliament and the Council of the EU each need to agree their own positions and then reconcile them before anything is adopted, a process that routinely takes a year or more for a package touching this many existing laws. Once adopted, the current proposal gives ENISA up to 18 months to have the SEP operational, extendable to 24 months if the Commission finds it does not yet meet the integrity, reliability, and confidentiality standards the proposal sets. In practical terms, financial entities should not expect the SEP to replace their current DORA reporting channel this year, or plan around a hard date until a final text is agreed.

What financial entities should do now

Do not change your reporting process yet. File major incidents through your existing channel to your competent authority under the current Article 19 timeline. The proposal does not relieve that duty.
Track the file, do not chase every draft. The text will move through amendments in Parliament and Council; treat committee-stage detail as provisional and revisit your compliance programme once a political agreement is reached, not on every negotiating round.
Map your overlapping duties now. If your entity also has NIS2, CER, or GDPR notification obligations for the same categories of incident, list where those duties currently require separate filings. That map is what will tell you how much a working SEP would actually save you.
Keep ownership clear. Whoever owns DORA incident reporting inside your organisation should also own tracking this proposal, since a shared reporting channel would touch the same detection-to-notification workflow your ICT risk-management framework already feeds.
Use the wait productively. A DORA Readiness Score assessment can confirm your incident-reporting maturity against today's rules, which is the foundation any future SEP integration would sit on top of, not a substitute for it.

The bigger picture

DORA was built with the possibility of further centralisation in mind: Article 21 said as much when it commissioned the ESAs' feasibility study. What has changed is the scope of the answer on the table. Instead of a financial-sector hub built and run by financial supervisors, the EU is now considering a cross-sector portal built and run by its cybersecurity agency, serving several regimes DORA never contemplated sharing a channel with. Whether that ends up simplifying reporting for financial entities or adding a new layer of coordination between ENISA and the ESAs is exactly what the next year or two of negotiation will decide. Until then, the compliance obligation that matters is the one already in force.

Frequently asked questions

Does the EU's Digital Omnibus change DORA's incident-reporting rules today?

No. The Digital Omnibus is a proposal presented by the European Commission on 19 November 2025. It has to pass through the European Parliament and the Council of the EU before anything changes, so DORA's existing Article 19 reporting flow, timelines, and templates remain in force.

What is the Single-Entry Point (SEP) the Digital Omnibus proposes?

A single reporting portal, developed and operated by ENISA, that would let an organisation submit one incident notification and have it routed to every authority with a claim to it under NIS2, the CER Directive, eIDAS, GDPR, and DORA, instead of filing separately under each regime.

How is the SEP different from the single EU Hub DORA's Article 21 already studied?

Article 21 required the EBA, ESMA, and EIOPA to study a finance-sector-only hub run by the supervisors themselves. The SEP the Commission has now proposed is broader and differently owned: a cross-regime portal run by ENISA, covering entities under NIS2 and the CER Directive alongside DORA-regulated financial entities.

When would the Single-Entry Point actually be available?

Not soon. The proposal is still subject to negotiation between the European Parliament and the Council, and even once adopted, it gives ENISA up to 18 months to make the SEP operational, extendable to 24 months if the Commission finds it is not yet ready.

Should financial entities change how they report incidents while this proposal is pending?

No. Entities should keep reporting major incidents through their existing channel under the current DORA rules. The most useful preparation is mapping where the same incident currently triggers separate filings under NIS2, CER, or GDPR, so the potential benefit of a shared channel is already understood.

Does the Digital Omnibus only affect incident reporting under DORA?

No. The wider Digital Omnibus package also proposes changes to GDPR, the ePrivacy Directive, and the Data Act. The Single-Entry Point for incident reporting is one strand of a larger simplification effort across the EU's digital rulebook.

Sources

Regulation (EU) 2022/2554 (DORA), Articles 19-21, EUR-Lex.
European Banking Authority, ESAs publish study on feasibility of further centralisation of major ICT-related incident reporting by financial entities (17 January 2025).
European Securities and Markets Authority, ESAs publish study on feasibility of further centralisation of major ICT-related incident reporting by financial entities (17 January 2025).
European Parliamentary Research Service, Simplifying cybersecurity reporting: The Digital Omnibus Single-Entry Point mechanism, European Parliament Think Tank.

Last updated: 21 September 2026.