Digital Omnibus Incident Reporting: Council Picks National Entry Points

On 21 October 2026 the Council of the EU agreed its negotiating mandate on the Digital Omnibus, the Commission’s November 2025 proposal to simplify EU data protection, privacy and cybersecurity rules. On Digital Omnibus incident reporting, the Council rewrote the Commission’s design. The Commission wanted ENISA to run one EU single-entry point for incident notifications under NIS2, the GDPR, DORA, eIDAS and the Critical Entities Resilience (CER) Directive. The Council text, published on 22 October as document 14756/26, gives that role to a national entry point in each member state.

For a Hungarian financial entity the stakes are concrete. An ICT incident at a credit institution that also compromises customer data can already require three notifications: a DORA major-incident report to the Magyar Nemzeti Bank (MNB) through its ERA system, a notice to the national CSIRT under the Credit Institutions Act, and a personal data breach notification to the competent GDPR supervisory authority (NAIH, where it is competent). The Council text keeps all three recipients.

If adopted, the Council mandate would require Hungary to establish a national entry point for notifications covered by the amended EU legislation, including DORA and GDPR notifications. It does not expressly require Hungary’s separate Hpt. section 67/A CSIRT notifications to pass through that point; any such integration would depend on Hungary’s national arrangements. The mandate also proposes a 96-hour GDPR notification deadline for high-risk breaches, with national-entry-point reporting obligations deferred until 30 months after entry into force.

Current reporting is unaffected: the mandate is the Council’s opening position for trilogues, and Parliament’s committees had not voted when the Council acted.

Related reading: DORA ICT Incident Reporting: How to Classify, Escalate, and Report Major Incidents

Digital Omnibus incident reporting dates in the Council text

Article 11 of the Council text has the regulation enter into force on the third day after publication in the Official Journal. The incident-reporting deadlines count from that day, so no calendar date exists yet.

The 30-month date is a Council change. The Commission had proposed 18 months, stretching to 24 only if its own assessment found the EU portal unreliable.

An ENISA signpost, and an entry point in every member state

The Commission’s draft Article 23a of NIS2 had ENISA build the single-entry point, pilot it within 18 months and open it only after a Commission notice in the Official Journal. The Council strikes all of that. Its Article 23a gives ENISA an incident reporting information point that identifies which obligations apply, directs the entity to the right national entry point and documents each member state’s notification process. Under Article 23a(4) it cannot accept, transmit or store a notification, or collect anything identifying the entity or the incident.

The filing route moves to a new Article 23b. Each member state “shall establish and maintain” a national entry point, may configure it around existing structures, including by connecting existing systems, and “shall endeavour” to make it interoperable with other member states’ entry points. Recital 50a describes it as an interface, platform or interoperability hub through which notifications reach the competent authorities, CSIRTs or other designated authorities, without necessarily changing how functions are divided among them.

Under the Council mandate, there would be no common EU-level filing destination for notifications under NIS2, the GDPR, DORA, eIDAS and CER. ENISA’s proposed NIS2 Article 23a information point would direct entities to national entry points but would not receive incident reports. This does not affect ENISA’s separate Cyber Resilience Act Single Reporting Platform under Article 16 of Regulation (EU) 2024/2847, which has been operational since 11 September 2026 for notifications under Article 14.

DORA filings keep their recipient, content and clock

Article 8 of the mandate rewrites only the first subparagraphs of DORA Article 19(1) and (2). Financial entities would still report major ICT-related incidents to the competent authority referred to in Article 46, now “with the support of the national entry point”. Voluntary notifications of significant cyber threats get the same wording. The Commission had written “via the single-entry point”.

The verbs differ across the amended acts. Amended NIS2 Article 23(1) still has entities notify “via” the national entry point; the DORA, GDPR and CER amendments say “with the support of” it. The DORA wording reads as keeping the competent authority as the addressee, with the entry point as a supporting route. The text does not define “support”.

The content and time limits for initial, intermediate and final reports sit in Delegated Regulation (EU) 2025/301, and the forms in Implementing Regulation (EU) 2025/302. The Council text amends neither. Recital 54 tells member states to take due account of the DORA regulatory technical standards on report content (Delegated Regulation (EU) 2025/301) and the NIS2 reporting templates when setting entry-point content for NIS2, CER and GDPR notifications, allowing sector-specific adaptation. Our breakdown of the ESAs’ DORA major incident filing instructions covers the fields involved.

A central DORA hub was examined before: the ESAs’ January 2025 feasibility report under DORA Article 21 (JC 2024/108) concluded that a single EU hub would need a separate legal mandate or a delegation project.

GDPR breach notification: 96 hours, high-risk breaches only

Under the current GDPR Article 33(1), as the EDPB and NAIH describe it, a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals. The Council backs the Commission’s rewrite: only a breach “likely to result in a high risk” would be notifiable, without undue delay and, where feasible, not later than 96 hours after the controller becomes aware of it, with reasons for any later notice.

Recital 39 keeps the duty to document every breach under Article 33(5) and to carry out an individual risk assessment, so the breach register stays complete even when no notification is due. A new Article 33(6) has the EDPB publish lists of circumstances that are, and are not, likely to result in a high risk. A new Article 33(8) has the EDPB propose a common breach-notification template for the Commission to adopt by implementing act; the Commission’s draft had placed that template in Article 33(6), and the Council moved it to its own paragraph.

Until the entry point exists, Article 33(1a) keeps notifications going directly to the supervisory authority. Article 11 applies the Article 33 amendments 18 months after entry into force but defers “the obligations to report via the national entry point” to 30 months. On that reading, the 96-hour, high-risk test would apply first and the channel later. Every breach notified today still runs on 72 hours and the current risk threshold.

Hungary: three current notification routes to map

Under section 18(3) of MNB Decree 43/2025 (XII. 4.), in force since 1 January 2026, credit institutions, financial enterprises, payment institutions and electronic money institutions, other than Eximbank, MFB and third-country branches, submit major ICT-related incident reports and significant cyber threat notifications through the ERA system’s “DORA Incidens bejelentés” service, on the 2025/302 form, with an advanced or qualified electronic signature.

Section 67/A(4) of the Credit Institutions Act (Act CCXXXVII of 2013, Hpt.) adds the national CSIRT as a second recipient of major ICT-related incident notifications for credit institutions and financial enterprises; under section 67/A(5), a voluntary cyber threat notification to the MNB goes to the CSIRT at the same time. Where NAIH is the competent GDPR supervisory authority, controllers can submit notifiable personal data breaches through its online incident notification system or using its form via e-Papír. For cross-border processing, the controller must assess whether another supervisory authority is the lead authority under GDPR Article 56.

The perimeters differ. The MNB decree’s ERA duty reaches payment and e-money institutions; the Hpt. CSIRT copy is written for credit institutions and financial enterprises, and for payment and e-money institutions, section 12/B(1) of Act CCXXXV of 2013 has them notify the national CSIRT of major ICT-related incidents in line with DORA Article 19, and section 12/B(2) pairs a voluntary significant cyber threat notification to the MNB with a simultaneous CSIRT notification (consolidated text dated 1 October 2026 on the Nemzeti Jogszabálytár). For the wider 2026 reporting changes, see Hungary’s 2026 MNB reporting decree amendments.

Article 23b(2) is written for this kind of set-up, letting a member state connect existing systems and route information between authorities. How Hungary would do it is left to national choice, and none of the sources reviewed here sets out a Hungarian design.

What incident teams can map before trilogues end

The Council mandate proposes national reporting entry points and changes to the GDPR breach-notification threshold and deadline. It also contains proposals for CRA-to-NIS2 reporting equivalence, cross-border incident coordination and further harmonisation work. It does not amend the existing DORA, NIS2 or CER notification deadlines and thresholds. Proposed NIS2 Article 23c(1) would require the Commission to compare the reporting frameworks and consider possible further harmonisation steps and a timeline, followed by ENISA guidelines on templates, sectoral thresholds and notification stages.

A flow map per incident type can be built now: trigger, legal basis, recipient, channel, signature and first deadline for the ERA filing, the CSIRT notification (Hpt. section 67/A or Act CCXXXV of 2013 section 12/B, by entity type) and the GDPR breach notice, with the DORA report fields flagged (content under 2025/301, form under 2025/302) because recital 54 names the DORA regulatory technical standards and the NIS2 reporting templates as the reference. The ESAs’ first annual DORA incident report gives sector context for the volumes involved.

Whether Parliament keeps the national model is open. In early November 2026 the Legislative Observatory still showed the file awaiting committee decision, with ITRE and LIBE jointly responsible.

Frequently Asked Questions

If a national entry point fails during an incident, does the reporting deadline move?

Recital 57 of the Council mandate envisages alternative notification means in the exceptional event that a technical impossibility prevents submission through a national entry point; it does not extend reporting deadlines or override existing filing procedures. For DORA, Article 4(2) of Implementing Regulation (EU) 2025/302 already requires an entity unable to use its competent authority’s secure electronic channel to use other secure means agreed with that authority. If a DORA reporting deadline cannot be met, Article 5(3) of Delegated Regulation (EU) 2025/301 requires the entity to inform the competent authority and explain the delay no later than the original deadline.

Our group includes a manufacturer of products with digital elements. Does its Cyber Resilience Act report count for NIS2?

The Council mandate proposes adding NIS2 Article 23(12). If enacted, a manufacturer’s severe-incident notification under Article 14(3) of Regulation (EU) 2024/2847 would satisfy the information-reporting requirements of NIS2 Article 23(4) where it contains the required information. This equivalence is not currently in force: manufacturers must assess their applicable CRA and NIS2 notification obligations separately. The proposed provision would not discharge any DORA or GDPR notification obligation.

Related Articles

• DORA Major Incident Reporting: The ESAs’ Filing Instructions: the ESAs’ September 2026 operational instructions on fields to freeze, monetary values and conditional filing rules.
• DORA ICT Incident Reporting: What the ESAs First Annual Report Reveals: the first annual report on major ICT-related incidents reported under DORA.
• CSSF Incident Handling Guidance: NIS2 Rulebooks and the DORA Clock: how Luxembourg authorities divide NIS2 incident handling alongside DORA reporting.
• MNB Reporting Decrees 32/2026 and 33/2026: Hungary’s 1 October Reset: amendments to Hungary’s statistical and capital-market reporting decrees.

Key Takeaways

• Escalation playbooks keep MNB, the CSIRT and the competent GDPR supervisory authority (NAIH where competent) as recipients; ENISA’s proposed information point is a lookup service that takes no report (Article 23a(4)), while ENISA’s CRA Single Reporting Platform is unaffected.
• Two switch dates count from entry into force: 18 months for the amended GDPR Article 33 test and 30 months for the national-entry-point channel (Article 11, as read here).
• DORA content, clocks and forms in Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302 are outside the mandate’s amendments.
• Tag the DORA report fields (2025/301 content, 2025/302 form) in the incident flow map: recital 54 names the DORA regulatory technical standards (2025/301) and the NIS2 reporting templates as the reference for entry-point content.
• Diarise the Commission report proposed under NIS2 Article 23c(1), due six months after entry into force if the provision is adopted. The report would compare incident-reporting definitions, thresholds, deadlines, formats and procedures and consider possible further harmonisation. It would not itself change DORA, NIS2 or CER reporting obligations.
• Hungarian payment and e-money institutions map the CSIRT notification under section 12/B of Act CCXXXV of 2013; section 67/A of the Hpt. covers credit institutions and financial enterprises.

Sources and References

• Council of the EU, press release on the Digital Omnibus mandate (21 October 2026, updated 22 October 2026): consilium.europa.eu
• Council document 14756/26, Digital Omnibus mandate for negotiations with the European Parliament (22 October 2026): data.consilium.europa.eu (PDF)
• European Parliament Legislative Observatory, procedure 2025/0360(COD), incl. COM(2025) 837: oeil.europarl.europa.eu
• EU Law Tracker, Digital Omnibus timeline: law-tracker.europa.eu
• Directive (EU) 2022/2555 (NIS2): EUR-Lex
• Regulation (EU) 2022/2554 (DORA): EUR-Lex
• Delegated Regulation (EU) 2025/301: EUR-Lex
• Implementing Regulation (EU) 2025/302: EUR-Lex
• Regulation (EU) 2016/679 (GDPR): EUR-Lex
• Directive (EU) 2022/2557 (CER Directive): EUR-Lex
• Regulation (EU) No 910/2014 (eIDAS): EUR-Lex
• Regulation (EU) 2024/2847 (Cyber Resilience Act): EUR-Lex
• ENISA, Single Reporting Platform (CRA): enisa.europa.eu
• EDPB, “Personal data breaches: what to do”: edpb.europa.eu (PDF)
• ESAs, JC 2024/108, feasibility report on further centralisation of major ICT-related incident reporting: esma.europa.eu (PDF)
• MNB Decree 43/2025 (XII. 4.), section 18(3): Nemzeti Jogszabálytár
• Act CCXXXVII of 2013 (Hpt.), section 67/A: Nemzeti Jogszabálytár
• Act CCXXXV of 2013, section 12/B: Nemzeti Jogszabálytár
• NAIH data breach notification system: naih.hu

Hungarian Incident Filing Until the Entry Point Exists

Until any adopted amendments become applicable, Hungarian entities must follow the existing reporting requirements for their own status and incident. Entities covered by section 18(3) of MNB Decree 43/2025 submit major ICT-related incident reports through ERA. Credit institutions and financial enterprises also notify the national CSIRT under section 67/A(4) of the Hpt., and payment and e-money institutions do so under section 12/B(1) of Act CCXXXV of 2013. Controllers notify the competent GDPR supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals. For cross-border processing, that supervisory authority is not necessarily NAIH.

The artifact to produce now is the flow map with the DORA report fields marked; the next procedural milestone to monitor is the joint ITRE and LIBE committee decision. Parliament’s negotiating position remains subject to the applicable parliamentary procedure after that committee decision and before trilogues can proceed.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.