{
  "profile_view_schema": "actproof.profile_view.v1",
  "profile_view_type": "public_projection",
  "profile_view_semantics": "derived renderable view, not the canonical catalogue entry",
  "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
  "assessment_id": null,
  "generated_from": "actproof-events public export layer",
  "canonical_object": {
    "kind": "actproof-events catalogue entry",
    "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
    "catalogue_entry_hash": "sha256:11d7f8ed9b896f73a1e82bc17133626200758ecb3764f0f5e2bb66744cd5c337",
    "catalogue_entry_hash_basis": "sha256(raw catalogue entry JSON file bytes)"
  },
  "profile": {
    "display_name": "DORA major ICT-related incident initial notification (Article 19(4))",
    "claim_type": "ict_incident_notification_initial",
    "version": 2,
    "maturity": "candidate",
    "regulatory_citation": {
      "instrument": "Regulation (EU) 2022/2554",
      "article": "19(4)",
      "jurisdiction": "EU",
      "in_force_from": "2025-01-17"
    },
    "catalogue_entry_hash": "sha256:11d7f8ed9b896f73a1e82bc17133626200758ecb3764f0f5e2bb66744cd5c337",
    "catalogue_entry_hash_basis": "sha256(raw catalogue entry JSON file bytes)",
    "compatible_with_receipts": true,
    "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
    "boundary_id": "actproof.boundary.v1",
    "claim_flags": {
      "legal_advice": false,
      "legal_certification": false,
      "supervisory_approval": false,
      "compliance_determination": false
    },
    "non_claims": [
      "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
      "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
      "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
      "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
      "does_not_constitute_the_final_legal_classification_of_the_incident",
      "does_not_predetermine_supervisory_findings_or_sanctions",
      "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
      "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
    ],
    "required_evidence_labels": [
      "classification_committee_record",
      "detection_system_log_excerpt"
    ],
    "interpretive_summary": {
      "direct": 5,
      "derived": 6,
      "interpretive": 4,
      "unscored": 12
    }
  },
  "source_basis": {
    "scope": "mixed",
    "instruments": [
      {
        "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
        "authority": "European Parliament and Council of the European Union",
        "provisions": [
          "Article 19"
        ],
        "celex": "32022R2554",
        "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
        "sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c"
      },
      {
        "instrument": "Commission Delegated Regulation (EU) 2025/301",
        "authority": "European Commission",
        "provisions": [
          "Article 1",
          "Article 2",
          "Article 5"
        ],
        "celex": "32025R0301",
        "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
        "sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf"
      },
      {
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "provisions": [
          "Annex I",
          "Annex II"
        ],
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c"
      },
      {
        "instrument": "Commission Delegated Regulation (EU) 2024/1772",
        "authority": "European Commission",
        "provisions": [
          "Articles 1 to 8"
        ],
        "celex": "32024R1772",
        "eli": "http://data.europa.eu/eli/reg_del/2024/1772/oj",
        "sha256": "sha256:416fb104161f8b3eb0aae2601060ab869b1672cfa8452d20798800301538ceab"
      }
    ],
    "source_atoms": [
      {
        "source_atom_id": "src.eu.dora.32022R2554.art19.reporting_obligation",
        "source_binding_id": "sb_dora_reg_2022_2554",
        "source_id": "CELEX:32022R2554",
        "celex": "32022R2554",
        "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
        "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
        "authority": "European Parliament and Council of the European Union",
        "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
        "atom_type": "article",
        "locator": {
          "article": "19"
        },
        "source_role": "base_obligation",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Article 19 is the base DORA incident-reporting obligation for major ICT-related incidents.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:5523f32eef854c2a1690261bb8e43bcca843bc34c39c378dcd49b1a2dba7335e",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final",
        "source_binding_id": "sb_dora_reg_2022_2554",
        "source_id": "CELEX:32022R2554",
        "celex": "32022R2554",
        "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
        "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
        "authority": "European Parliament and Council of the European Union",
        "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
        "atom_type": "paragraph",
        "locator": {
          "article": "19",
          "paragraph": "4"
        },
        "source_role": "reporting_sequence",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Article 19(4) anchors the initial notification, intermediate report and final report sequence.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:55831936c77680f9d799e35a6c3c73b21120bfa5a011146304a1e4ba46b9042a",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32022R2554.art19.competent_authority_channel",
        "source_binding_id": "sb_dora_reg_2022_2554",
        "source_id": "CELEX:32022R2554",
        "celex": "32022R2554",
        "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
        "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
        "authority": "European Parliament and Council of the European Union",
        "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
        "atom_type": "paragraph",
        "locator": {
          "article": "19"
        },
        "source_role": "reporting_channel",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Article 19 provides the competent-authority reporting context for major ICT-related incident notifications.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:5a352fa940634dd3bb0dc85211c46d74cead1b245da5ccf29ec4010d305a3179",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0301.art1.content_rules",
        "source_binding_id": "sb_dora_reg_2025_0301",
        "source_id": "CELEX:32025R0301",
        "celex": "32025R0301",
        "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
        "instrument": "Commission Delegated Regulation (EU) 2025/301",
        "authority": "European Commission",
        "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
        "atom_type": "article",
        "locator": {
          "article": "1"
        },
        "source_role": "content_requirement",
        "normative_weight": "supporting",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Delegated Regulation 2025/301 sets content requirements for reports and notifications.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:b59ea406b673b8bed37dbdd123430d811e421da8364ba0ece8d9837be7a6d651",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
        "source_binding_id": "sb_dora_reg_2025_0301",
        "source_id": "CELEX:32025R0301",
        "celex": "32025R0301",
        "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
        "instrument": "Commission Delegated Regulation (EU) 2025/301",
        "authority": "European Commission",
        "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
        "atom_type": "article",
        "locator": {
          "article": "2"
        },
        "source_role": "content_requirement",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Article 2 provides content requirements for the initial notification.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0301.art5.time_limits",
        "source_binding_id": "sb_dora_reg_2025_0301",
        "source_id": "CELEX:32025R0301",
        "celex": "32025R0301",
        "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
        "instrument": "Commission Delegated Regulation (EU) 2025/301",
        "authority": "European Commission",
        "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
        "atom_type": "article",
        "locator": {
          "article": "5"
        },
        "source_role": "time_limit",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Article 5 provides time-limit context for DORA incident-reporting stages.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:0843e55d0f7d0ad16742d2bb03fe78d5f7c01369feb054985cfaddae6af62db8",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.general_information",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_section",
        "locator": {
          "annex": "I",
          "section": "General information"
        },
        "source_role": "template_section",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Annex I contains the general information section for the reporting template.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:1046485644457d0f15fcc57aef038503c833726cf42e2692aa20206d2362929b",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_section",
        "locator": {
          "annex": "I",
          "section": "Initial notification"
        },
        "source_role": "template_section",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Annex I contains the initial-notification reporting section.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "glossary_entry",
        "locator": {
          "annex": "II"
        },
        "source_role": "data_glossary",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Annex II provides the data glossary and instructions for completing the template.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.entity_lei",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "General information",
          "field": "Legal entity identifier"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the financial entity legal identifier.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:b2c9094d0f6f77cd15e686f1a3db2f7f075f81f97dd316fdd1accaec5f9aa792",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.entity_name",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "General information",
          "field": "Name of financial entity"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the financial entity legal name.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:a0d7cb4d1bc38956a9f983b22405891f996ffb03a222e6bdcb141e4ee5ce74f7",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.financial_entity_type",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "General information",
          "field": "Type of financial entity"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the financial entity type/category.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:c3e6201986ace7715a69046d3dbb135445c0abe2048c8b554d17f7fc48281136",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.submission_type",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "General information",
          "field": "Type of report"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template/report metadata field identifying the reporting stage or submission type.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:a5d460c543dbf76d74b29ad93e41403ef0881e0f818398568b962da4bbe986c7",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.incident_reference_code",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "General information",
          "field": "Incident reference code"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the incident reference identifier.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:ae28fca9591f227e62f3ba61c69e19614a3bdea46647948744eb327bdeb9e609",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.detection_datetime",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Date and time of detection"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the date and time when the incident was detected.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:677501c720757559146774b3e949d5ba00d79fe868e22fb5c3fa05c7c113b29f",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.classification_datetime",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Date and time of classification"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the date and time when the incident was classified as major.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:41eae1b35a32263a7ab87a5a486d810db763c7a0923024b3bd29115225629d2f",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.classification_criteria",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Classification criteria"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field recording the incident-classification criteria triggered.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:6aedfb7e9c6e7b8b50bff55b68625d15321bdac6ea6ff5cfaabe706ab4ec9ebf",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.affected_member_states",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Affected Member States"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for Member States affected by the incident.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:5b94caea38605870f6a1e3a9fb1c2ad48e0d62f2a1333b5a2ac58718ce64f2c2",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.discovery_method",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Incident discovery method"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for how the incident was detected or discovered.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:3c99d37fab371833f1cac2d241fe5b009ba6c7415404595f74ba46e10b34e7df",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.bcp_activated",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Business continuity plan activated"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field indicating whether a business continuity plan was activated.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:17b0f5adf5e69ca45d61c8f4f035f1d28a043135f6923adbaf6bb686c4acee62",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_impact_description",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Initial notification",
          "field": "Initial impact description"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the initial narrative impact description.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:4615d79f4aeb4faf6dd0b53bb80d6ebe1639d48cfd9c82fd835066661b31ade3",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.primary_contact_name",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Contact details",
          "field": "Primary contact name"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the primary contact person name.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:2b99549b67a83a681ce245104cc1a66a2350ace2927abeef7ab353f7399e2adf",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.primary_contact_email",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "Contact details",
          "field": "Primary contact email"
        },
        "source_role": "template_field",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Template field for the primary contact email address.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:d553997c15165825e522838231ed2c67ce975e50419447e669d3acb2534bb127",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32025R0302.annexI.competent_authority",
        "source_binding_id": "sb_dora_reg_2025_0302",
        "source_id": "CELEX:32025R0302",
        "celex": "32025R0302",
        "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
        "instrument": "Commission Implementing Regulation (EU) 2025/302",
        "authority": "European Commission",
        "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
        "atom_type": "template_field",
        "locator": {
          "annex": "I",
          "section": "General information",
          "field": "Competent authority"
        },
        "source_role": "template_field",
        "normative_weight": "supporting",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Operational template context for the competent authority receiving the report.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:b8367917da801a8a8f8a6cfdfae06ae3141ebb274726bf8e92419cce5575580b",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32024R1772.art1to7.classification_criteria",
        "source_binding_id": "sb_dora_reg_2024_1772",
        "source_id": "CELEX:32024R1772",
        "celex": "32024R1772",
        "eli": "http://data.europa.eu/eli/reg_del/2024/1772/oj",
        "instrument": "Commission Delegated Regulation (EU) 2024/1772",
        "authority": "European Commission",
        "source_document_sha256": "sha256:416fb104161f8b3eb0aae2601060ab869b1672cfa8452d20798800301538ceab",
        "atom_type": "classification_rule",
        "locator": {
          "articles": "1-7"
        },
        "source_role": "classification_criteria",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Articles 1 to 7 define the classification criteria used to assess ICT-related incidents.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:5d38d61205f2a92e05a0a3a8add2ca2749c6a064c779645226e23ce878a9527c",
        "official_text_sha256": null,
        "binding_status": "provisional"
      },
      {
        "source_atom_id": "src.eu.dora.32024R1772.art8.major_incident_determination",
        "source_binding_id": "sb_dora_reg_2024_1772",
        "source_id": "CELEX:32024R1772",
        "celex": "32024R1772",
        "eli": "http://data.europa.eu/eli/reg_del/2024/1772/oj",
        "instrument": "Commission Delegated Regulation (EU) 2024/1772",
        "authority": "European Commission",
        "source_document_sha256": "sha256:416fb104161f8b3eb0aae2601060ab869b1672cfa8452d20798800301538ceab",
        "atom_type": "threshold_rule",
        "locator": {
          "article": "8"
        },
        "source_role": "major_incident_threshold",
        "normative_weight": "primary",
        "language": "en",
        "text_excerpt": "",
        "atom_hash_basis": "sha256 over a canonical JSON serialisation (sorted keys) of the atom's identity fields: source_atom_id, celex, eli, atom_type, locator, source_role, normative_weight, source_document_sha256, derivation_note. Reproducible via actproof_events.source_binding.compute_source_atom_identity_hash. This is an identity hash, NOT a hash of official legal text; see official_text_sha256.",
        "derivation_note": "Article 8 provides the major-incident determination logic based on the classification criteria.",
        "review_status": "draft",
        "atom_identity_sha256": "sha256:b4d4425b08d002862fe2edde8a0b5406f676a791f2b8831ab68cb6eaf5fb6857",
        "official_text_sha256": null,
        "binding_status": "provisional"
      }
    ],
    "field_derivations": [
      {
        "field_id": "entity_legal_identifier",
        "required": true,
        "derivation_type": "direct_template_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.entity_lei",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "derivation_note": "The field is a direct institutional identifier in the reporting template and glossary instructions.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "entity_legal_name",
        "required": true,
        "derivation_type": "direct_template_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.entity_name",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "derivation_note": "The field is a direct institutional identity field in the reporting template.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "financial_entity_type",
        "required": true,
        "derivation_type": "transformed_template_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.financial_entity_type",
          "src.eu.dora.32025R0302.annexII.data_glossary",
          "src.eu.dora.32022R2554.art19.reporting_obligation"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 2,
        "derivation_note": "The field records the regulated-entity category using the template and glossary context; selection depends on the entity taxonomy.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "submission_type",
        "required": true,
        "derivation_type": "direct_template_metadata",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.submission_type",
          "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "derivation_note": "The field identifies the reporting stage in the DORA incident-reporting sequence.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "incident_reference_code",
        "required": true,
        "derivation_type": "normalised_template_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.incident_reference_code",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 1,
        "derivation_note": "The field normalises the institution’s incident reference into the reporting-template identifier field.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "detection_datetime_utc",
        "required": true,
        "derivation_type": "normalised_time_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.detection_datetime",
          "src.eu.dora.32025R0301.art5.time_limits",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 1,
        "derivation_note": "The field normalises the detection timestamp for time-limit and reporting-template purposes.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "classification_datetime_utc",
        "required": true,
        "derivation_type": "reconciled_time_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.classification_datetime",
          "src.eu.dora.32025R0301.art5.time_limits",
          "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 3,
        "derivation_note": "The field reconciles the classification timestamp with the reporting sequence and timing rules.",
        "non_claims": [
          "does_not_constitute_final_legal_classification"
        ],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "classification_criteria_triggered",
        "required": true,
        "derivation_type": "interpretive_classification_mapping",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.classification_criteria",
          "src.eu.dora.32024R1772.art1to7.classification_criteria",
          "src.eu.dora.32024R1772.art8.major_incident_determination",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 4,
        "derivation_note": "The field records which classification criteria were triggered. The template carries the field; the classification RTS supplies the substantive criteria; the initial-notification RTS supplies the content context.",
        "non_claims": [
          "does_not_constitute_final_legal_classification",
          "does_not_replace_competent_authority_assessment"
        ],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "affected_member_states",
        "required": true,
        "derivation_type": "reconciled_jurisdiction_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.affected_member_states",
          "src.eu.dora.32025R0302.annexII.data_glossary",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 3,
        "derivation_note": "The field reconciles template reporting with operational analysis of affected jurisdictions.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "incident_discovery_method",
        "required": true,
        "derivation_type": "transformed_operational_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.discovery_method",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 2,
        "derivation_note": "The field transforms operational detection context into the reporting-template discovery-method field.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "business_continuity_plan_activated",
        "required": true,
        "derivation_type": "normalised_boolean_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.bcp_activated",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 1,
        "derivation_note": "The field normalises business-continuity activation evidence into a boolean reporting field.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "initial_impact_description",
        "required": true,
        "derivation_type": "modelled_narrative_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_impact_description",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 4,
        "derivation_note": "The field models a provisional narrative impact description from the initial-notification content requirement and reporting template.",
        "non_claims": [
          "does_not_constitute_final_impact_assessment"
        ],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "primary_contact_name",
        "required": true,
        "derivation_type": "direct_contact_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.primary_contact_name",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "derivation_note": "The field is a direct contact-information field in the reporting template.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "primary_contact_email",
        "required": true,
        "derivation_type": "direct_contact_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.primary_contact_email",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "derivation_note": "The field is a direct contact-email field in the reporting template.",
        "non_claims": [],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "competent_authority",
        "required": true,
        "derivation_type": "transformed_reporting_channel_field",
        "source_atoms": [
          "src.eu.dora.32022R2554.art19.competent_authority_channel",
          "src.eu.dora.32025R0302.annexI.competent_authority"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": 2,
        "derivation_note": "The field links the reporting channel and competent-authority context to the operational recipient field.",
        "non_claims": [
          "does_not_determine_national_supervisory_routing"
        ],
        "release_scope": "required_release_scope",
        "binding_granularity": "template_field"
      },
      {
        "field_id": "secondary_contact_name",
        "required": false,
        "derivation_type": "direct_source_mapping",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.general_information",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Secondary contact information is optional support for report contact details. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional field; private disclosure downstream.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section",
        "binding_granularity_detail": "glossary"
      },
      {
        "field_id": "secondary_contact_email",
        "required": false,
        "derivation_type": "direct_source_mapping",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.general_information",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Secondary contact email is optional support for report contact details. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional field; private disclosure downstream.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section",
        "binding_granularity_detail": "glossary"
      },
      {
        "field_id": "first_disruption_datetime_utc",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "First disruption time may be known at initial-notification stage but is associated with more detailed or later reporting. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional early information, not required initial-notification content.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section"
      },
      {
        "field_id": "affected_functions_and_services",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Affected functions/services may be known early and are relevant to incident impact, but are treated as optional in this profile. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional early information.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section"
      },
      {
        "field_id": "preliminary_estimated_clients_affected",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Preliminary affected-client estimate may be known early but is treated as optional in this profile. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional early information.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section"
      },
      {
        "field_id": "preliminary_estimated_financial_amount",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Preliminary financial amount may be known early and needs separate currency handling. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional early information; currency separation handled by reporting_currency.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section"
      },
      {
        "field_id": "reporting_currency",
        "required": false,
        "derivation_type": "direct_source_mapping",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0302.annexII.data_glossary"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Reporting currency is modelled separately from amount fields to avoid hard-coded assumptions. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Direct/supporting field, also a modelling correction.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section",
        "binding_granularity_detail": "glossary"
      },
      {
        "field_id": "third_party_provider_involved",
        "required": false,
        "derivation_type": "interpretive_mapping",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Third-party involvement can matter to the DORA reporting context and reporting-on-behalf arrangements. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional, interpretive, and disclosure-sensitive.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section"
      },
      {
        "field_id": "outsourcing_arrangement_reference",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32025R0302.annexI.initial_notification",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Outsourcing reference supports third-party reporting context where relevant. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Optional operational-support field, not required initial-notification content.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "template_section"
      },
      {
        "field_id": "linked_threat_notification_reference",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32022R2554.art19.reporting_obligation",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Optional cross-reference to a related threat notification when such record exists. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Cross-regime link only; not DORA-required content.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "obligation_context"
      },
      {
        "field_id": "linked_nis2_notification_reference",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32022R2554.art19.reporting_obligation",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Optional cross-reference to a related NIS2 notification when such record exists. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Cross-regime link only; DORA notification does not replace NIS2 obligations.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "obligation_context"
      },
      {
        "field_id": "linked_gdpr_breach_notification_reference",
        "required": false,
        "derivation_type": "operational_support_field",
        "source_atoms": [
          "src.eu.dora.32022R2554.art19.reporting_obligation",
          "src.eu.dora.32025R0301.art2.initial_notification_content"
        ],
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "derivation_note": "Optional cross-reference to a related GDPR breach notification when such record exists. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "review_note": "Cross-regime link only; DORA notification does not replace GDPR obligations.",
        "non_claims": [],
        "release_scope": "experimental_optional",
        "binding_granularity": "obligation_context"
      }
    ]
  },
  "evidence": {
    "required_evidence_labels": [
      "classification_committee_record",
      "detection_system_log_excerpt"
    ],
    "evidence_scope": "profile"
  },
  "coverage": {
    "field_counts": {
      "total": 27,
      "required": 15,
      "optional": 12
    },
    "field_source_basis": {
      "field_level": 15,
      "contextual_field_level": 12,
      "act_level_fallback": 0,
      "fallback_used": 0,
      "coverage_ratio": 55.6,
      "coverage_basis": "release_gated_template_field_bindings",
      "by_scope": {
        "field_template": 15,
        "field_contextual": 12,
        "act": 0
      }
    },
    "required_field_source_basis": {
      "required_total": 15,
      "field_level": 15,
      "template_cell_bound": 15,
      "fallback_used": 0,
      "coverage_ratio": 100.0,
      "coverage_basis": "required_template_field_bindings"
    },
    "evidence_scope": {
      "field_level": 0,
      "profile_level": 27
    },
    "assessment": {
      "scored_fields": 15,
      "unscored_fields": 12,
      "coverage_ratio": 55.6,
      "by_interpretive_status": {
        "derived": 6,
        "direct": 5,
        "interpretive": 4,
        "unscored": 12
      },
      "by_mapping_type": {
        "direct": 5,
        "modelled": 2,
        "normalised": 3,
        "reconciled": 2,
        "transformed": 3,
        "unscored": 12
      }
    },
    "disclosure": {
      "tiered_fields": 22,
      "untiered_fields": 5,
      "coverage_ratio": 81.5,
      "by_tier": {
        "commitment": 9,
        "private": 6,
        "public": 7,
        "untiered": 5
      }
    },
    "optional_field_source_basis": {
      "optional_total": 12,
      "field_level": 12,
      "template_cell_bound": 0,
      "section_or_obligation_bound": 12,
      "act_level_fallback": 0,
      "coverage_ratio": 0.0,
      "coverage_basis": "optional_template_field_bindings_only",
      "release_scope": "experimental_optional"
    },
    "source_binding_precision": {
      "template_field": 15,
      "template_section": 9,
      "obligation_context": 3,
      "act_fallback": 0
    },
    "source_atom_coverage": {
      "total_source_atoms": 26,
      "atoms_used_by_fields": 25,
      "unused_source_atoms": 1,
      "unused_source_atom_ids": [
        "src.eu.dora.32025R0301.art1.content_rules"
      ],
      "atoms_with_required_field_bindings": 23,
      "atoms_only_in_contextual_bindings": 2,
      "atoms_only_in_contextual_binding_ids": [
        "src.eu.dora.32025R0302.annexI.general_information",
        "src.eu.dora.32025R0302.annexI.initial_notification"
      ],
      "dangling_atom_references": 0,
      "dangling_atom_reference_ids": [],
      "coverage_basis": "atoms_referenced_by_at_least_one_field_derivation",
      "interpretation_note": "An unused source atom means a recorded provision is not yet represented by any field. It is a gap signal for review, not a defect. This coverage does not prove the atom set itself is exhaustive of the underlying instruments."
    }
  },
  "non_claims": [
    "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
    "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
    "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
    "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
    "does_not_constitute_the_final_legal_classification_of_the_incident",
    "does_not_predetermine_supervisory_findings_or_sanctions",
    "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
    "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
  ],
  "boundary": {
    "boundary_id": "actproof.boundary.v1",
    "text": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice."
  },
  "completeness": {
    "completeness_status": "candidate",
    "review_status": "draft",
    "known_scope": "DORA major ICT-related incident INITIAL notification: the 15 required template-field obligations and 12 contextual optional fields, bound to the pinned DORA stack (Reg 2022/2554, Delegated 2025/301 RTS, Implementing 2025/302 ITS, Delegated 2024/1772 classification).",
    "not_exhaustive_of": [
      "DORA intermediate report",
      "DORA final report",
      "national competent authority portal-specific requirements",
      "institution-specific internal escalation requirements",
      "provisions of the underlying instruments not yet recorded as source atoms",
      "future supervisory Q&A or guidance"
    ],
    "field_id_policy": {
      "universal_claim": false,
      "note": "Field IDs are stable identifiers within this ActProof profile, not universal market field names. A bank, GRC vendor, auditor or agent may use different names for the same concept and still align by source atom, template locator, required status, data type and evidence expectation. The field name is not the authority; the source binding is.",
      "align_by": [
        "source_atom_overlap",
        "template_locator",
        "semantic_meaning",
        "required_status",
        "data_type",
        "evidence_expectation",
        "interpretive_load",
        "disclosure_tier"
      ],
      "do_not_align_by": [
        "field_name_alone",
        "vendor_label_alone",
        "form_position_alone",
        "assumption_that_unmapped_means_irrelevant"
      ]
    },
    "challenge_allowed": true,
    "challenge_types": [
      "missing_field",
      "wrong_source_atom",
      "weak_derivation",
      "incorrect_required_status",
      "outdated_source",
      "ambiguous_mapping"
    ],
    "challenge_channel": "https://github.com/deyan-paroushev/actproof-events/issues",
    "self_reported_gaps_note": "Run `actproof-events source-atom-coverage` to see which recorded source atoms are not yet represented by any field. As of this release, 1 of 26 atoms is unused (src.eu.dora.32025R0301.art1.content_rules) - a known, disclosed gap, not a hidden one."
  },
  "governance": {
    "schema": "actproof.profile_governance_status.v1",
    "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
    "package": {
      "name": "actproof-events",
      "version": "2.4.0"
    },
    "lifecycle_state": "candidate",
    "profile_semantic_hash": "sha256:08283721f9084cfd006df44b501a7f506e9058049209f5e403b75a188d821f50",
    "profile_artifact_hash": "sha256:88a591624f62fc48606e7d14da0c8673a11e2988e59fadac05e5c153c867eb41",
    "latest_review_status": "maintainer_reviewed",
    "latest_review_record_hash": "sha256:e7193f594a2e73dd4f078f12fea56d96f0ea9be368c3cd34ca57a978b8a8d710",
    "review_type": "maintainer_source_binding_and_bank_operability_review",
    "reviewed_field_ids": [
      "affected_functions_and_services",
      "business_continuity_plan_activated",
      "detection_datetime_utc",
      "entity_legal_identifier",
      "entity_legal_name",
      "first_disruption_datetime_utc",
      "incident_reference_code",
      "linked_gdpr_breach_notification_reference",
      "linked_nis2_notification_reference",
      "linked_threat_notification_reference",
      "outsourcing_arrangement_reference",
      "preliminary_estimated_clients_affected",
      "preliminary_estimated_financial_amount",
      "primary_contact_email",
      "primary_contact_name",
      "reporting_currency",
      "secondary_contact_email",
      "secondary_contact_name",
      "submission_type",
      "third_party_provider_involved"
    ],
    "held_at_draft_field_ids": [
      "affected_member_states",
      "classification_criteria_triggered",
      "classification_datetime_utc",
      "competent_authority",
      "financial_entity_type",
      "incident_discovery_method",
      "initial_impact_description"
    ],
    "review_limitations": [
      "maintainer review only",
      "not external legal review",
      "not bank SME approval",
      "not supervisory approval",
      "not compliance certification",
      "high-interpretation field derivations NOT maintainer-reviewed: affected_member_states, classification_criteria_triggered, classification_datetime_utc, competent_authority, financial_entity_type, incident_discovery_method, initial_impact_description"
    ],
    "open_challenges": 1,
    "blocking_challenges": 0,
    "challenge_summary": {
      "total": 1,
      "open": 1,
      "blocking": 0,
      "by_type": {
        "coverage_gap": 1
      },
      "by_status": {
        "open": 1
      }
    },
    "bank_use_boundary": "Suitable for local POC (Proof of Concept) and internal review support under explicit boundaries; not standalone compliance authority, legal advice, factual verification, or regulatory submission.",
    "bank_poc_pitch": "Run ActProof locally against one DORA initial-notification draft and one internal field list. It will show missing required fields, high-judgement fields, source atoms, evidence expectations, source-atom coverage, and where field names need reviewed mapping.",
    "governance_status_hash": "sha256:2047d1b1dc8b981e58d6531e515fb500aac79c6fa176f644dadbeec775180f7d"
  },
  "fields": [
    {
      "field_id": "entity_legal_identifier",
      "required": true,
      "type": "string",
      "disclosure_tier": "public",
      "interpretive_status": "direct",
      "mapping_type": "direct",
      "interpretive_load": 0,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Direct. Stable institutional identifier (LEI).",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.entity_lei",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "General information",
            "field": "Legal entity identifier"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:b2c9094d0f6f77cd15e686f1a3db2f7f075f81f97dd316fdd1accaec5f9aa792",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.entity_lei",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_template_field",
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field is a direct institutional identifier in the reporting template and glossary instructions.",
        "non_claims": []
      }
    },
    {
      "field_id": "entity_legal_name",
      "required": true,
      "type": "string",
      "disclosure_tier": "public",
      "interpretive_status": "direct",
      "mapping_type": "direct",
      "interpretive_load": 0,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Direct. Stable institutional identity.",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.entity_name",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "General information",
            "field": "Name of financial entity"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:a0d7cb4d1bc38956a9f983b22405891f996ffb03a222e6bdcb141e4ee5ce74f7",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.entity_name",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_template_field",
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field is a direct institutional identity field in the reporting template.",
        "non_claims": []
      }
    },
    {
      "field_id": "financial_entity_type",
      "required": true,
      "type": "string",
      "disclosure_tier": "public",
      "interpretive_status": "derived",
      "mapping_type": "transformed",
      "interpretive_load": 2,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Transformed. Category selection against the regulated-entity typology.",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.financial_entity_type",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "General information",
            "field": "Type of financial entity"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:c3e6201986ace7715a69046d3dbb135445c0abe2048c8b554d17f7fc48281136",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.reporting_obligation",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "article",
          "locator": {
            "article": "19"
          },
          "source_role": "base_obligation",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:5523f32eef854c2a1690261bb8e43bcca843bc34c39c378dcd49b1a2dba7335e",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.financial_entity_type",
        "src.eu.dora.32025R0302.annexII.data_glossary",
        "src.eu.dora.32022R2554.art19.reporting_obligation"
      ],
      "field_derivation": {
        "derivation_type": "transformed_template_field",
        "mapping_confidence": "draft",
        "interpretive_load": 2,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field records the regulated-entity category using the template and glossary context; selection depends on the entity taxonomy.",
        "non_claims": []
      }
    },
    {
      "field_id": "submission_type",
      "required": true,
      "type": "string",
      "disclosure_tier": "public",
      "interpretive_status": "direct",
      "mapping_type": "direct",
      "interpretive_load": 0,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Direct. Phase or template metadata.",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.submission_type",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "General information",
            "field": "Type of report"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:a5d460c543dbf76d74b29ad93e41403ef0881e0f818398568b962da4bbe986c7",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "paragraph",
          "locator": {
            "article": "19",
            "paragraph": "4"
          },
          "source_role": "reporting_sequence",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:55831936c77680f9d799e35a6c3c73b21120bfa5a011146304a1e4ba46b9042a",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.submission_type",
        "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final"
      ],
      "field_derivation": {
        "derivation_type": "direct_template_metadata",
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field identifies the reporting stage in the DORA incident-reporting sequence.",
        "non_claims": []
      }
    },
    {
      "field_id": "incident_reference_code",
      "required": true,
      "type": "string",
      "disclosure_tier": "commitment",
      "interpretive_status": "derived",
      "mapping_type": "normalised",
      "interpretive_load": 1,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Normalised. Internal reference; log-backed; commitment-only disclosure.",
      "evidence_burden": 1,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.incident_reference_code",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "General information",
            "field": "Incident reference code"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:ae28fca9591f227e62f3ba61c69e19614a3bdea46647948744eb327bdeb9e609",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.incident_reference_code",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "normalised_template_field",
        "mapping_confidence": "draft",
        "interpretive_load": 1,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field normalises the institution’s incident reference into the reporting-template identifier field.",
        "non_claims": []
      }
    },
    {
      "field_id": "detection_datetime_utc",
      "required": true,
      "type": "datetime",
      "disclosure_tier": "public",
      "interpretive_status": "derived",
      "mapping_type": "normalised",
      "interpretive_load": 1,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Normalised. Timestamp normalisation; log-backed.",
      "evidence_burden": 1,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.detection_datetime",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Date and time of detection"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:677501c720757559146774b3e949d5ba00d79fe868e22fb5c3fa05c7c113b29f",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art5.time_limits",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "5"
          },
          "source_role": "time_limit",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:0843e55d0f7d0ad16742d2bb03fe78d5f7c01369feb054985cfaddae6af62db8",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.detection_datetime",
        "src.eu.dora.32025R0301.art5.time_limits",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "normalised_time_field",
        "mapping_confidence": "draft",
        "interpretive_load": 1,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field normalises the detection timestamp for time-limit and reporting-template purposes.",
        "non_claims": []
      }
    },
    {
      "field_id": "classification_datetime_utc",
      "required": true,
      "type": "datetime",
      "disclosure_tier": "public",
      "interpretive_status": "interpretive",
      "mapping_type": "reconciled",
      "interpretive_load": 3,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": true,
      "rationale": "Reconciled. Depends on when the institution classified the incident.",
      "evidence_burden": 1,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.classification_datetime",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Date and time of classification"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:41eae1b35a32263a7ab87a5a486d810db763c7a0923024b3bd29115225629d2f",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art5.time_limits",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "5"
          },
          "source_role": "time_limit",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:0843e55d0f7d0ad16742d2bb03fe78d5f7c01369feb054985cfaddae6af62db8",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "paragraph",
          "locator": {
            "article": "19",
            "paragraph": "4"
          },
          "source_role": "reporting_sequence",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:55831936c77680f9d799e35a6c3c73b21120bfa5a011146304a1e4ba46b9042a",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.classification_datetime",
        "src.eu.dora.32025R0301.art5.time_limits",
        "src.eu.dora.32022R2554.art19.p4.initial_intermediate_final"
      ],
      "field_derivation": {
        "derivation_type": "reconciled_time_field",
        "mapping_confidence": "draft",
        "interpretive_load": 3,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field reconciles the classification timestamp with the reporting sequence and timing rules.",
        "non_claims": [
          "does_not_constitute_final_legal_classification"
        ]
      }
    },
    {
      "field_id": "classification_criteria_triggered",
      "required": true,
      "type": "string_list",
      "disclosure_tier": "commitment",
      "interpretive_status": "interpretive",
      "mapping_type": "modelled",
      "interpretive_load": 4,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": true,
      "rationale": "Modelled. High-judgement classification requiring committee evidence.",
      "evidence_burden": 2,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.classification_criteria",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Classification criteria"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:6aedfb7e9c6e7b8b50bff55b68625d15321bdac6ea6ff5cfaabe706ab4ec9ebf",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32024R1772.art1to7.classification_criteria",
          "source_binding_id": "sb_dora_reg_2024_1772",
          "source_id": "CELEX:32024R1772",
          "celex": "32024R1772",
          "eli": "http://data.europa.eu/eli/reg_del/2024/1772/oj",
          "instrument": "Commission Delegated Regulation (EU) 2024/1772",
          "atom_type": "classification_rule",
          "locator": {
            "articles": "1-7"
          },
          "source_role": "classification_criteria",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:416fb104161f8b3eb0aae2601060ab869b1672cfa8452d20798800301538ceab",
          "atom_identity_sha256": "sha256:5d38d61205f2a92e05a0a3a8add2ca2749c6a064c779645226e23ce878a9527c",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32024R1772.art8.major_incident_determination",
          "source_binding_id": "sb_dora_reg_2024_1772",
          "source_id": "CELEX:32024R1772",
          "celex": "32024R1772",
          "eli": "http://data.europa.eu/eli/reg_del/2024/1772/oj",
          "instrument": "Commission Delegated Regulation (EU) 2024/1772",
          "atom_type": "threshold_rule",
          "locator": {
            "article": "8"
          },
          "source_role": "major_incident_threshold",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:416fb104161f8b3eb0aae2601060ab869b1672cfa8452d20798800301538ceab",
          "atom_identity_sha256": "sha256:b4d4425b08d002862fe2edde8a0b5406f676a791f2b8831ab68cb6eaf5fb6857",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.classification_criteria",
        "src.eu.dora.32024R1772.art1to7.classification_criteria",
        "src.eu.dora.32024R1772.art8.major_incident_determination",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "interpretive_classification_mapping",
        "mapping_confidence": "draft",
        "interpretive_load": 4,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field records which classification criteria were triggered. The template carries the field; the classification RTS supplies the substantive criteria; the initial-notification RTS supplies the content context.",
        "non_claims": [
          "does_not_constitute_final_legal_classification",
          "does_not_replace_competent_authority_assessment"
        ]
      }
    },
    {
      "field_id": "affected_member_states",
      "required": true,
      "type": "string_list",
      "disclosure_tier": "commitment",
      "interpretive_status": "interpretive",
      "mapping_type": "reconciled",
      "interpretive_load": 3,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": true,
      "rationale": "Reconciled. Depends on affected services, users, branches, jurisdictions.",
      "evidence_burden": 1,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.affected_member_states",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Affected Member States"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:5b94caea38605870f6a1e3a9fb1c2ad48e0d62f2a1333b5a2ac58718ce64f2c2",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.affected_member_states",
        "src.eu.dora.32025R0302.annexII.data_glossary",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "reconciled_jurisdiction_field",
        "mapping_confidence": "draft",
        "interpretive_load": 3,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field reconciles template reporting with operational analysis of affected jurisdictions.",
        "non_claims": []
      }
    },
    {
      "field_id": "incident_discovery_method",
      "required": true,
      "type": "string",
      "disclosure_tier": "commitment",
      "interpretive_status": "derived",
      "mapping_type": "transformed",
      "interpretive_load": 2,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Transformed. Operational categorisation from the detection process.",
      "evidence_burden": 1,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.discovery_method",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Incident discovery method"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:3c99d37fab371833f1cac2d241fe5b009ba6c7415404595f74ba46e10b34e7df",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.discovery_method",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "transformed_operational_field",
        "mapping_confidence": "draft",
        "interpretive_load": 2,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field transforms operational detection context into the reporting-template discovery-method field.",
        "non_claims": []
      }
    },
    {
      "field_id": "business_continuity_plan_activated",
      "required": true,
      "type": "boolean",
      "disclosure_tier": "untiered",
      "interpretive_status": "derived",
      "mapping_type": "normalised",
      "interpretive_load": 1,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Normalised, evidence-backed. Factual yes/no but evidence-backed.",
      "evidence_burden": 1,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.bcp_activated",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Business continuity plan activated"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:17b0f5adf5e69ca45d61c8f4f035f1d28a043135f6923adbaf6bb686c4acee62",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.bcp_activated",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "normalised_boolean_field",
        "mapping_confidence": "draft",
        "interpretive_load": 1,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field normalises business-continuity activation evidence into a boolean reporting field.",
        "non_claims": []
      }
    },
    {
      "field_id": "initial_impact_description",
      "required": true,
      "type": "text",
      "disclosure_tier": "commitment",
      "interpretive_status": "interpretive",
      "mapping_type": "modelled",
      "interpretive_load": 4,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": true,
      "rationale": "Modelled. Narrative, provisional, judgement-heavy.",
      "evidence_burden": 2,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_impact_description",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Initial notification",
            "field": "Initial impact description"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:4615d79f4aeb4faf6dd0b53bb80d6ebe1639d48cfd9c82fd835066661b31ade3",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_impact_description",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "modelled_narrative_field",
        "mapping_confidence": "draft",
        "interpretive_load": 4,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field models a provisional narrative impact description from the initial-notification content requirement and reporting template.",
        "non_claims": [
          "does_not_constitute_final_impact_assessment"
        ]
      }
    },
    {
      "field_id": "primary_contact_name",
      "required": true,
      "type": "string",
      "disclosure_tier": "private",
      "interpretive_status": "direct",
      "mapping_type": "direct",
      "interpretive_load": 0,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Direct. Personal/contact data.",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.primary_contact_name",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Contact details",
            "field": "Primary contact name"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:2b99549b67a83a681ce245104cc1a66a2350ace2927abeef7ab353f7399e2adf",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.primary_contact_name",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_contact_field",
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field is a direct contact-information field in the reporting template.",
        "non_claims": []
      }
    },
    {
      "field_id": "primary_contact_email",
      "required": true,
      "type": "email",
      "disclosure_tier": "private",
      "interpretive_status": "direct",
      "mapping_type": "direct",
      "interpretive_load": 0,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Direct. Personal/contact data.",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.primary_contact_email",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "Contact details",
            "field": "Primary contact email"
          },
          "source_role": "template_field",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:d553997c15165825e522838231ed2c67ce975e50419447e669d3acb2534bb127",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.primary_contact_email",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_contact_field",
        "mapping_confidence": "draft",
        "interpretive_load": 0,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field is a direct contact-email field in the reporting template.",
        "non_claims": []
      }
    },
    {
      "field_id": "competent_authority",
      "required": true,
      "type": "string",
      "disclosure_tier": "public",
      "interpretive_status": "derived",
      "mapping_type": "transformed",
      "interpretive_load": 2,
      "rubric_id": "evidence_layer_complexity.v1",
      "interpretive": false,
      "rationale": "Transformed. Depends on jurisdiction, channel, supervisory allocation.",
      "evidence_burden": 0,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.competent_authority_channel",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "paragraph",
          "locator": {
            "article": "19"
          },
          "source_role": "reporting_channel",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:5a352fa940634dd3bb0dc85211c46d74cead1b245da5ccf29ec4010d305a3179",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.competent_authority",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_field",
          "locator": {
            "annex": "I",
            "section": "General information",
            "field": "Competent authority"
          },
          "source_role": "template_field",
          "normative_weight": "supporting",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:b8367917da801a8a8f8a6cfdfae06ae3141ebb274726bf8e92419cce5575580b",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_field",
      "release_scope": "required_release_scope",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": true,
      "counts_toward_field_level_coverage": true,
      "source_atoms": [
        "src.eu.dora.32022R2554.art19.competent_authority_channel",
        "src.eu.dora.32025R0302.annexI.competent_authority"
      ],
      "field_derivation": {
        "derivation_type": "transformed_reporting_channel_field",
        "mapping_confidence": "draft",
        "interpretive_load": 2,
        "binding_granularity": "template_field",
        "release_scope": "required_release_scope",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "The field links the reporting channel and competent-authority context to the operational recipient field.",
        "non_claims": [
          "does_not_determine_national_supervisory_routing"
        ]
      }
    },
    {
      "field_id": "secondary_contact_name",
      "required": false,
      "type": "string",
      "disclosure_tier": "private",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.general_information",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "General information"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:1046485644457d0f15fcc57aef038503c833726cf42e2692aa20206d2362929b",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.general_information",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_source_mapping",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Secondary contact information is optional support for report contact details. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "secondary_contact_email",
      "required": false,
      "type": "email",
      "disclosure_tier": "private",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.general_information",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "General information"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:1046485644457d0f15fcc57aef038503c833726cf42e2692aa20206d2362929b",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.general_information",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_source_mapping",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Secondary contact email is optional support for report contact details. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "first_disruption_datetime_utc",
      "required": false,
      "type": "datetime",
      "disclosure_tier": "untiered",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "First disruption time may be known at initial-notification stage but is associated with more detailed or later reporting. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "affected_functions_and_services",
      "required": false,
      "type": "string_list",
      "disclosure_tier": "commitment",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Affected functions/services may be known early and are relevant to incident impact, but are treated as optional in this profile. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "preliminary_estimated_clients_affected",
      "required": false,
      "type": "integer",
      "disclosure_tier": "commitment",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Preliminary affected-client estimate may be known early but is treated as optional in this profile. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "preliminary_estimated_financial_amount",
      "required": false,
      "type": "number",
      "disclosure_tier": "commitment",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Preliminary financial amount may be known early and needs separate currency handling. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "reporting_currency",
      "required": false,
      "type": "string",
      "disclosure_tier": "untiered",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexII.data_glossary",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "glossary_entry",
          "locator": {
            "annex": "II"
          },
          "source_role": "data_glossary",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:dd24c0f5cd7ad1ea73df88c6775aed7f85962c32b4e75d2c0f1f9ae3f7f2aa34",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0302.annexII.data_glossary"
      ],
      "field_derivation": {
        "derivation_type": "direct_source_mapping",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Reporting currency is modelled separately from amount fields to avoid hard-coded assumptions. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "third_party_provider_involved",
      "required": false,
      "type": "boolean",
      "disclosure_tier": "commitment",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "interpretive_mapping",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Third-party involvement can matter to the DORA reporting context and reporting-on-behalf arrangements. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "outsourcing_arrangement_reference",
      "required": false,
      "type": "string",
      "disclosure_tier": "private",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32025R0302.annexI.initial_notification",
          "source_binding_id": "sb_dora_reg_2025_0302",
          "source_id": "CELEX:32025R0302",
          "celex": "32025R0302",
          "eli": "http://data.europa.eu/eli/reg_impl/2025/302/oj",
          "instrument": "Commission Implementing Regulation (EU) 2025/302",
          "atom_type": "template_section",
          "locator": {
            "annex": "I",
            "section": "Initial notification"
          },
          "source_role": "template_section",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:37ec431c7a11b8b30b39d1c1f0d95c39539d1c1e7236301ee3b06bb229ff009c",
          "atom_identity_sha256": "sha256:e635f18e65202798ce0a75a5e047975108a794cbd5f3a8d69f44247226387601",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "template_section",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32025R0302.annexI.initial_notification",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "template_section",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Outsourcing reference supports third-party reporting context where relevant. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "linked_threat_notification_reference",
      "required": false,
      "type": "string",
      "disclosure_tier": "private",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.reporting_obligation",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "article",
          "locator": {
            "article": "19"
          },
          "source_role": "base_obligation",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:5523f32eef854c2a1690261bb8e43bcca843bc34c39c378dcd49b1a2dba7335e",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "obligation_context",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32022R2554.art19.reporting_obligation",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "obligation_context",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Optional cross-reference to a related threat notification when such record exists. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "linked_nis2_notification_reference",
      "required": false,
      "type": "string",
      "disclosure_tier": "untiered",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.reporting_obligation",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "article",
          "locator": {
            "article": "19"
          },
          "source_role": "base_obligation",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:5523f32eef854c2a1690261bb8e43bcca843bc34c39c378dcd49b1a2dba7335e",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "obligation_context",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32022R2554.art19.reporting_obligation",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "obligation_context",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Optional cross-reference to a related NIS2 notification when such record exists. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    },
    {
      "field_id": "linked_gdpr_breach_notification_reference",
      "required": false,
      "type": "string",
      "disclosure_tier": "untiered",
      "interpretive_status": "unscored",
      "mapping_type": null,
      "interpretive_load": null,
      "rubric_id": null,
      "interpretive": false,
      "rationale": "",
      "evidence_burden": null,
      "evidence_labels": [
        "classification_committee_record",
        "detection_system_log_excerpt"
      ],
      "evidence_scope": "profile",
      "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
      "regulatory_citation": {
        "instrument": "Regulation (EU) 2022/2554",
        "article": "19(4)",
        "jurisdiction": "EU"
      },
      "source_basis": [
        {
          "source_atom_id": "src.eu.dora.32022R2554.art19.reporting_obligation",
          "source_binding_id": "sb_dora_reg_2022_2554",
          "source_id": "CELEX:32022R2554",
          "celex": "32022R2554",
          "eli": "http://data.europa.eu/eli/reg/2022/2554/oj",
          "instrument": "Regulation (EU) 2022/2554 (Digital Operational Resilience Act)",
          "atom_type": "article",
          "locator": {
            "article": "19"
          },
          "source_role": "base_obligation",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:85307f9e2a0409826dd0f54489645935816d16e929f0db4db3ef15badd11d38c",
          "atom_identity_sha256": "sha256:5523f32eef854c2a1690261bb8e43bcca843bc34c39c378dcd49b1a2dba7335e",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        },
        {
          "source_atom_id": "src.eu.dora.32025R0301.art2.initial_notification_content",
          "source_binding_id": "sb_dora_reg_2025_0301",
          "source_id": "CELEX:32025R0301",
          "celex": "32025R0301",
          "eli": "http://data.europa.eu/eli/reg_del/2025/301/oj",
          "instrument": "Commission Delegated Regulation (EU) 2025/301",
          "atom_type": "article",
          "locator": {
            "article": "2"
          },
          "source_role": "content_requirement",
          "normative_weight": "primary",
          "source_document_sha256": "sha256:47a209a9f73e228e85e1dad2934d917d5791629fc98add06fc6fda0acb872dbf",
          "atom_identity_sha256": "sha256:2adfb1967067006371705e12f843b575f3f2d7f653c21383043ee707f39bf672",
          "official_text_sha256": null,
          "binding_status": "provisional",
          "review_status": "draft"
        }
      ],
      "source_basis_scope": "field",
      "fallback_used": false,
      "non_claims": [
        "does_not_constitute_an_admission_of_liability_by_the_financial_entity",
        "does_not_imply_a_breach_of_contract_with_clients_or_counterparties",
        "does_not_replace_the_separate_notification_obligation_under_directive_eu_2022_2555_nis2",
        "does_not_replace_a_personal_data_breach_notification_under_regulation_eu_2016_679_gdpr_article_33",
        "does_not_constitute_the_final_legal_classification_of_the_incident",
        "does_not_predetermine_supervisory_findings_or_sanctions",
        "does_not_exhaust_the_intermediate_and_final_reporting_obligations_under_dora_article_19_4",
        "does_not_prove_the_notification_was_transmitted_to_or_received_by_the_competent_authority"
      ],
      "boundary": "ActProof shows what a machine-readable profile claims and where it came from. It does not certify legal compliance and is not legal advice.",
      "boundary_id": "actproof.boundary.v1",
      "binding_granularity": "obligation_context",
      "release_scope": "experimental_optional",
      "field_binding_status": "provisional_locator_bound",
      "counts_toward_required_release_gate": false,
      "counts_toward_field_level_coverage": false,
      "source_atoms": [
        "src.eu.dora.32022R2554.art19.reporting_obligation",
        "src.eu.dora.32025R0301.art2.initial_notification_content"
      ],
      "field_derivation": {
        "derivation_type": "operational_support_field",
        "mapping_confidence": "draft",
        "interpretive_load": null,
        "binding_granularity": "obligation_context",
        "release_scope": "experimental_optional",
        "field_binding_status": "provisional_locator_bound",
        "derivation_note": "Optional cross-reference to a related GDPR breach notification when such record exists. [experimental_optional: bound to existing section/obligation atoms, not a distinct reviewed template cell]",
        "non_claims": []
      }
    }
  ],
  "provenance": {
    "generated_from": "actproof-events",
    "package_name": "actproof-events",
    "package_version": "2.4.0",
    "export_function": "actproof_events.exports.build_profile_view",
    "cli_command": "actproof-events export-profile-view",
    "act_id": "op:eu.dora.ict_incident_notification_initial.v1",
    "assessment_id": null,
    "catalogue_entry_hash": "sha256:11d7f8ed9b896f73a1e82bc17133626200758ecb3764f0f5e2bb66744cd5c337",
    "catalogue_entry_hash_basis": "sha256(raw catalogue entry JSON file bytes)",
    "profile_view_schema": "actproof.profile_view.v1",
    "profile_view_type": "public_projection",
    "profile_view_semantics": "derived renderable view, not the canonical catalogue entry",
    "source_binding_release": "field_level_required_fields.v1",
    "generated_at": "2026-06-07T09:34:42Z"
  },
  "profile_semantic_hash_basis": "sha256 over canonical JSON with sorted keys and compact separators, excluding profile hash fields, hash-basis fields and provenance",
  "profile_artifact_hash_basis": "sha256 over canonical JSON with sorted keys and compact separators, excluding profile hash fields and provenance.generated_at; including provenance.package_version",
  "profile_view_hash_basis": "sha256 over canonical JSON with sorted keys and compact separators, excluding profile hash fields, hash-basis fields and provenance",
  "profile_semantic_hash": "sha256:437ba6c1ff2266f3ef062ace27019491a615ffff61931cd3f471e03a10a07094",
  "profile_view_hash": "sha256:437ba6c1ff2266f3ef062ace27019491a615ffff61931cd3f471e03a10a07094",
  "profile_artifact_hash": "sha256:ad5cd2c2453b196ae50b0f0166c34825f54e45b30853c4da0f668700a732157d"
}