IcelandDigital Operational Resilience of the Financial Market: ICT-Related Incident Management and Reporting
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.althingi.is/lagas/nuna/2025078.htmlIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which Article 1 of Act 78/2025 gives the force of law in Iceland, other than Byggðastofnun, Lánasjóður sveitarfélaga and Náttúruhamfaratrygging Íslands (Article 12). Reached by declaring that you provide financial services.
- Put in place the ICT-related incident management process that Article 17 of Regulation (EU) 2022/2554 requires (Act 78/2025, Article 5, item 3).
- Classify ICT-related incidents and cyber threats as paragraphs 1 and 2 of Article 18 of the Regulation require (Act 78/2025, Article 5, item 4).
- Report serious ICT-related incidents as paragraphs 1, 3 and 4 of Article 19 of the Regulation require (Act 78/2025, Article 5, item 5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 5 sets a fine for a legal entity of ISK 500,000 to ISK 800,000,000, which may however be higher or up to 10 percent of total turnover according to the last approved annual accounts of the legal entity; a fine on an individual runs from ISK 100,000 to ISK 65,000,000, and the fine may reach twice the financial gain from the breach.
- Rule
- Higher of
- As of
- Minimum
- 500,000
- Currency
- ISK
- Fixed cap
- 800,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The Financial Supervisory Authority (Fjármálaeftirlitið), which supervises compliance with the Act and may fine a breach of the listed Articles of Regulation (EU) 2022/2554 under Article 5; the Central Bank of Iceland is the competent authority under Article 3.
Settledness
- As of
What this law does
Article 5 of Act 78/2025 lets the Financial Supervisory Authority fine a person who breaches Article 17 of Regulation (EU) 2022/2554 on the ICT-related incident management process. Article 5 also lets the Authority fine a breach of the duty to classify ICT-related incidents and cyber threats under Article 18 of the Regulation. Article 5 further lets the Authority fine a breach of the duty to report serious ICT-related incidents under paragraphs 1, 3 and 4 of Article 19 of the Regulation. Article 6 applies the administrative sanctions whether the breach was intentional or negligent.
When LexLint raises it
When your app profile says your app provides financial services.