NIS 2 incident reporting: the 24-hour, 72-hour and one-month deadlines
Under Article 23 of Directive (EU) 2022/2555 (NIS 2), an essential or important entity that suffers a significant incident reports it to its national CSIRT or, where applicable, its competent authority: an early warning without undue delay and in any event within 24 hours of becoming aware of the incident, an incident notification within 72 hours of becoming aware of it, an intermediate report if asked, and a final report not later than one month after the incident notification. A trust service provider sends its notification within 24 hours for incidents affecting its trust services. The clock starts at awareness, not when the analysis ends; the channel, forms and language are set by national transposition law.
What a significant incident is under Article 23
Article 6(6) defines an incident as "an event compromising the availability, authenticity, integrity or confidentiality" of data, or of the services offered by or accessible via network and information systems. Only significant incidents must be reported. Under Article 23(3), an incident is significant if:
- it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned; or
- it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
The words "capable of" matter: an incident can be significant before the damage has happened. For DNS, cloud, data centre, managed service and other digital providers named in Article 23(11), Implementing Regulation (EU) 2024/2690 of 17 October 2024 specifies further when an incident is significant. Other entities apply the two criteria above, as detailed by their national law. Incidents below the threshold, cyber threats and near misses can be reported voluntarily under Article 30, without creating new obligations.
The three deadlines on a timeline
| Step (Article 23(4)) | Deadline | Counted from | Minimum content |
|---|---|---|---|
| (a) Early warning | Without undue delay, within 24 hours | Becoming aware of the significant incident | Where applicable, whether the incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact |
| (b) Incident notification | Without undue delay, within 72 hours (24 hours for trust service providers) | Becoming aware of the significant incident | Update of the early warning; initial assessment, including severity and impact; indicators of compromise where available |
| (c) Intermediate report | When requested | The request of the CSIRT or competent authority | Relevant status updates |
| (d) Final report | Not later than one month | Submission of the incident notification | Detailed description, including severity and impact; type of threat or likely root cause; applied and ongoing mitigation measures; cross-border impact where applicable |
| (e) Progress report | When the final report is due, if the incident is still ongoing | Same date as the final report | Progress so far; the final report then follows within one month of the handling of the incident |
Two details trip teams up. The 72 hours run from awareness, not from the early warning. The one month for the final report runs from the day the notification was actually submitted, so that date must be recorded. In return, Article 23(5) asks the CSIRT or authority to respond without undue delay and, where possible, within 24 hours of receiving the early warning.
Who you report to
- The CSIRT or the competent authority designated by your Member State (Article 23(1)). If the notification goes to the competent authority, that authority forwards it to the CSIRT.
- The recipients of your services, where appropriate and without undue delay, for significant incidents likely to adversely affect the provision of those services (Article 23(1)). For a significant cyber threat, you tell potentially affected recipients what measures or remedies they can take (Article 23(2)).
- The public, only if the CSIRT or competent authority decides it is necessary, after consulting you (Article 23(7)).
- The data protection authority, under a separate law: where personal data are breached, Article 33(1) of the General Data Protection Regulation requires notification without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.
The channel is national. In France, the National Assembly's legislative file, consulted on 20 October 2026, showed the transposition bill adopted by the Senate on 12 March 2025 and by the Assembly's special committee on 10 September 2025, with no plenary vote and no promulgated law. Check your own country's status and portal before an incident, not during one.
What each report must contain
Most fields can be prepared in advance in a template: entity, sector and 24/7 contact; date and time of awareness and how it arose; services and systems affected; suspected malicious cause and possible cross-border impact (yes, no or unknown); severity, impact and indicators of compromise; mitigation measures and, for the final report, the likely root cause.
Prepare the procedure before the incident
- Decide who classifies. Name a decision-maker, a deputy and a written grid based on the two criteria of Article 23(3). Any thresholds you add (outage duration, loss amount) are your own choice: record them with their reasoning.
- Start the clock in the register. Log the time of awareness at once; a later classification does not move it.
- Test the channel. Find the national portal, check who has an account, keep the contact details available offline.
- Align with the GDPR process. Both 72-hour periods can run at the same time: the NIS 2 lead and the data protection officer need one timeline.
- Ask suppliers to warn you quickly. Your clock may start with a supplier's message; see NIS 2 supply chain security for contract clauses.
- Rehearse with management. A tabletop exercise shows whether 24 hours is realistic. Incident handling is measure (b) of Article 21(2), explained in NIS 2 Article 21: the measures one by one.
Incident sheet template (fictitious example)
A one-page sheet per incident is enough if it carries the dates that drive the deadlines. The example below is fictitious.
| Field | Fictitious example |
|---|---|
| Entity and category | Medium-sized food processor, important entity |
| Became aware | 12 March, 09:40: IT team confirms encrypted files on two file servers |
| Classification | Significant, decided 12 March at 13:00: production planning unavailable, capable of causing severe operational disruption (Article 23(3)(a)) |
| Early warning | Due 13 March, 09:40. Sent 12 March, 16:30. Malicious act suspected: yes. Cross-border impact: unknown |
| Incident notification | Due 15 March, 09:40. Sent 14 March, 17:10, with initial assessment and indicators of compromise |
| Final report | Due 14 April, one month after the notification was sent |
| Personal data | None affected, checked by the data protection officer on 13 March |
| Owner | NIS 2 lead; deputy: IT manager |
Note that the classification at 13:00 does not change any due date: both the 24-hour and the 72-hour deadlines are counted from 09:40. The same reporting duties apply to essential and important entities alike; what differs is supervision, as explained in NIS 2: essential vs important entities. The incident procedure is also one line of the NIS 2 compliance checklist.
FAQ
Does the 24-hour deadline start when the incident happens?
No. Article 23(4)(a) counts it from becoming aware of the significant incident. The directive does not define the moment of awareness further, so record the time and the facts that established it; your national law or authority may give more detail.
What if we report an incident that turns out not to be significant?
Article 23(1) states that "the mere act of notification shall not subject the notifying entity to increased liability". Reporting below the threshold is also possible on a voluntary basis under Article 30.
Does a NIS 2 notification replace the GDPR notification?
No. The two are separate obligations to different authorities. Where an infringement of Articles 21 or 23 may entail a personal data breach, Article 35 of NIS 2 asks the competent authority to inform the data protection authority, and rules out a second NIS 2 fine for the same conduct once a GDPR fine has been imposed under Article 58(2)(i) of that regulation.