On 20 February 2025, the following was published in the Official Journal of the EU (OJ):

  • Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats.

Both the Commission Delegated Regulation and the Commission Implementing Regulation enter into force on the twentieth day following their publication in the OJ (12 March 2025).