Under NIS2 Article 23, a significant incident is reported in stages: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware, and a final report within one month of the notification. Trust service providers send the notification within 24 hours. Reports go to your national CSIRT or competent authority.
This guide covers the clock, each report, trust service providers, recipients, the CSIRT’s reply, customers, cross-border and voluntary reporting, national rules, and a timeline to copy.
| Stage | Deadline | What it contains | NIS2 |
|---|---|---|---|
| Early warning | Without undue delay, within 24 hours of becoming aware | Where applicable: suspected unlawful or malicious act; possible cross-border impact | Art. 23(4)(a) |
| CSIRT response | Without undue delay, where possible within 24 hours of receiving the early warning | Initial feedback; guidance on mitigation on request | Art. 23(5) |
| Incident notification | Without undue delay, within 72 hours of becoming aware (24 hours for trust service providers) | Update of the early warning; initial assessment of severity and impact; indicators of compromise where available | Art. 23(4)(b) |
| Intermediate report | On request of the CSIRT or authority | Relevant status updates | Art. 23(4)(c) |
| Final report | Not later than one month after the incident notification | Detailed description, severity and impact; threat type or root cause; mitigation applied and ongoing; cross-border impact where applicable | Art. 23(4)(d) |
| Progress report | If the incident is still ongoing when the final report is due | Progress report then; final report within one month of handling the incident | Art. 23(4)(e) |
When does the NIS2 24-hour clock start?
At the moment you become aware of the significant incident. Article 23(4)(a) requires the early warning “without undue delay and in any event within 24 hours of becoming aware of the significant incident”. The clock does not start when the attacker got in, and it does not wait for the investigation to finish.
Three details matter more than they look.
- Both deadlines run from awareness. The 72-hour notification is also counted from becoming aware, not from the early warning. Send the early warning at hour 23 and you have 49 hours left, not 72.
- The final report runs from the notification. It is due one month after you submit the incident notification. Submitting the notification early also starts the one-month clock early.
- 24 hours is the limit, not the target. The early warning and the incident notification are both “without undue delay” first. An early warning sent at hour 23, when you knew enough at hour 4, is hard to defend.
The directive does not define “becoming aware”. The alert and the conclusion that an incident is significant can be hours apart. A cautious approach takes the earlier time. Either way, record the time, who decided and on what facts: that record is what an authority will look at.
What goes in each NIS2 report?
Early warning, within 24 hours
Where applicable, it says whether the incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact. Recital 102 says it should contain only what the CSIRT needs to be aware of the incident, and should not divert resources from handling it. In practice: who you are, a contact, a short description, the services affected, and what you do not know yet.
Incident notification, within 72 hours
It updates the early warning and gives an initial assessment “including its severity and impact”, plus indicators of compromise where available: IP addresses, domains, file hashes. By now you should know which services, systems and customers are affected.
Intermediate report, on request
The CSIRT or competent authority can ask for status updates at any point. There is no fixed date.
Final report, within one month of the notification
Article 23(4)(d) lists four items:
- a detailed description of the incident, including its severity and impact;
- the type of threat or root cause that is likely to have triggered it;
- applied and ongoing mitigation measures;
- where applicable, the cross-border impact.
Progress report, if it is still going on
If the incident is still ongoing when the final report is due, you send a progress report at that time and the final report within one month of handling the incident.
Do trust service providers have a shorter deadline?
Yes. For significant incidents “that have an impact on the provision of its trust services”, a trust service provider sends the incident notification within 24 hours of becoming aware, instead of 72 (Article 23(4), second subparagraph). The early warning is also due within 24 hours, so both fall in the same window. A sensible approach is to prepare them as one submission where your national form allows it.
What counts as a significant incident?
Only significant incidents trigger the timeline. Under Article 23(3), that means an incident that has caused, or can cause, severe operational disruption of the services or financial loss for the entity. It also covers one that has affected, or can affect, others by causing considerable material or non-material damage.
Digital providers such as cloud, data centre and managed service providers have concrete thresholds in Implementing Regulation (EU) 2024/2690. One is direct financial loss above €500,000 or 5% of annual turnover, whichever is lower. How to make the call is in what makes an incident significant. Ransomware that stops a core service is the textbook case: see NIS2 and ransomware.
Who do you report to?
Your national CSIRT or, where applicable, your competent authority (Article 23(1)). National law decides which, and provides the channel. A competent authority forwards the notification to the CSIRT on receipt. For cross-border or cross-sectoral incidents, the single point of contact also gets the relevant information.
Financial entities are the main exception. Article 4 disapplies NIS2 reporting where a sector-specific EU act is at least equivalent. Recital 28 names DORA as that act for financial entities, so they report under DORA.
What does the CSIRT do with your early warning?
Article 23(5) requires the CSIRT or competent authority to respond without undue delay and where possible within 24 hours of receiving the early warning. The response includes initial feedback and, if you ask, guidance or operational advice on mitigation. The CSIRT provides additional technical support on request. If the incident looks criminal, you also get guidance on reporting it to law enforcement.
Notifying does not in itself make you more liable: “The mere act of notification shall not subject the notifying entity to increased liability” (Article 23(1)). It does not protect you from the consequences of the incident itself.
Your report may not stay private. Where public awareness is needed or in the public interest, the CSIRT or authority may inform the public, or require you to, after consulting you (Article 23(7)). Consultation, not consent.
Do you have to tell your customers?
Article 23 has two separate duties towards the recipients of your services.
Significant incidents, Article 23(1)
Where appropriate, you notify recipients without undue delay of significant incidents that are likely to adversely affect the provision of your services.
Significant cyber threats, Article 23(2)
Where applicable, you tell recipients who are potentially affected by a significant cyber threat “any measures or remedies” they can take in response. Where appropriate, you also inform them of the threat itself. The duty can apply before anything has happened to you.
A significant cyber threat is one that, “based on its technical characteristics, can be assumed to have the potential to have a severe impact” on your systems or users (Article 6(11)). Think of stolen customer credentials circulating online, or an exploited flaw in software your customers run.
Recital 103 adds that the information should be free of charge and easy to understand, and does not replace your own measures. In practice:
- Lead with what the recipient should do. A customer told “change your password now” is better served than one given a threat analysis and no instruction.
- Separate confirmed from suspected. “Your account was accessed” and “your account may be affected” are different messages.
- Use channels your recipients actually read, and prepare templates before you need them.
- Record who was told, when, through which channel and what they were told.
What happens with cross-border incidents?
You do not notify every affected country yourself. You report to your own CSIRT or authority, with the information it needs to judge cross-border impact (Article 23(1)). Where appropriate, in particular where two or more Member States are concerned, the CSIRT, authority or single point of contact informs the others and ENISA. It must protect your security and commercial interests and the confidentiality of your report (Article 23(6)). At the request of the CSIRT or authority, the single point of contact forwards your notification to its counterparts in other affected Member States (Article 23(8)).
The exception is an entity under more than one jurisdiction. Public electronic communications providers fall under each Member State where they provide services (Article 26), so each national regime applies.
Can you report voluntarily?
Yes. Article 30 lets essential and important entities notify incidents, cyber threats and near misses on top of their mandatory reports, whether significant or not. Any other entity, in scope or not, can notify significant incidents, cyber threats and near misses. A near miss is an event that could have compromised your data or services but was prevented or did not materialise (Article 6(5)).
Voluntary notifications follow the Article 23 procedure, though Member States may process mandatory ones first. Without prejudice to criminal investigations, a voluntary report does not impose obligations you would not otherwise have had.
How do national rules change the timeline?
The stages and deadlines come from the directive, so they are the same everywhere. National law sets the recipient, the channel, the form and sometimes the vocabulary. Recital 106 asks Member States to provide technical means such as a single entry point, online forms and templates.
In Luxembourg, for example, the 24-hour report is called a preliminary notification, and ILR-supervised entities file it through the SERIMA online form. The national procedure and a template are in NIS2 incident notification in Luxembourg. Check your own national law and your authority’s guidance before building the process.
What other reports can the same incident trigger?
NIS2 is often not the only clock.
- GDPR. For a personal data breach, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people’s rights and freedoms (GDPR Article 33). The overlap is in NIS2 and GDPR.
- Cyber Resilience Act. Since 11 September 2026, manufacturers report actively exploited vulnerabilities in their products and severe incidents affecting their security, starting with an early warning within 24 hours. See CRA reporting obligations.
- DORA, for financial entities, instead of NIS2.
In practice, run every report from one incident record so the facts and timestamps match.
What happens if you miss a NIS2 reporting deadline?
Infringing Article 23 is subject to administrative fines under Article 34. National law must allow maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher.
NIS2 incident reporting timeline to copy
NIS2 ARTICLE 23 REPORTING TIMELINE
T0 Entity becomes aware of a significant incident
Record: date, time (UTC), who decided, on what facts
T0 + 24h EARLY WARNING to CSIRT or competent authority
- suspected unlawful or malicious act? Y / N / unknown
- possible cross-border impact? Y / N / unknown
E + 24h CSIRT or authority responds, where possible
(E = early warning received): feedback, guidance
T0 + 72h INCIDENT NOTIFICATION
- update of the early warning
- initial assessment of severity and impact
- indicators of compromise, where available
Trust service providers: due at T0 + 24h
On request INTERMEDIATE REPORT: relevant status updates
N + 1 month FINAL REPORT (N = incident notification submitted)
- detailed description, severity and impact
- type of threat or root cause
- mitigation applied and ongoing
- cross-border impact, where applicable
Ongoing? PROGRESS REPORT at N + 1 month, then
FINAL REPORT within one month of handling
Alongside, without undue delay:
- recipients, significant incident (Art. 23(1))
- recipients, significant cyber threat (Art. 23(2))
- GDPR authority if personal data (72h where feasible)What should tooling do to support the NIS2 reporting timeline?
Article 23 is procedural. It says when to report and what to say, not how you find out, which is where the timeline is won or lost. A 24-hour clock is easy if you know at hour zero. It is impossible if the alert sat in a mailbox for three days.
The 72-hour notification is harder. Severity, impact and indicators of compromise mean knowing which services were hit, which customers depend on them, and what the attacker touched. That needs logs that were kept and can be queried, and a map from systems to services to customers. Many companies only draw that map when an incident forces them to.
When you compare vendors that claim to support NIS2 incident reporting, ask three questions. Does the tool record the moment of awareness and compute every deadline from it? Does one incident record feed the NIS2, GDPR and CRA reports? Can it show an authority, months later, what you knew and when? The CloudSoul platform works that way: automated evidence collection, with human-in-the-loop expertise for calls a tool should not make alone, such as whether an incident is significant. The wider programme is on the NIS2 compliance page.
NIS2 incident reporting checklist
- Name who decides an incident is significant, and a deputy, both reachable out of hours.
- Write down your national recipient and channel, and test access before you need it.
- Record the moment of awareness, and who decided, in every incident record.
- Pre-fill the early warning with entity details and contacts.
- Keep logs and a systems-to-services-to-customers map good enough to answer the 72-hour questions.
- Prepare customer notification templates for significant incidents and significant cyber threats.
- Link NIS2, GDPR and, if you make products, CRA reporting to one incident record.
- Rehearse the 24-hour and 72-hour clocks at least once a year.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 4, 6, 23, 26, 30 and 34 and recitals 28, 102, 103 and 106, EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2690, Articles 3 and 4, EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), Article 33, EUR-Lex.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14, EUR-Lex.
- Regulation (EU) 2022/2554 (DORA), Article 19, EUR-Lex.
Frequently asked questions
What is the NIS2 incident reporting timeline?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours of becoming aware, and a final report no later than one month after the incident notification. The CSIRT or authority can ask for intermediate reports, and an incident still ongoing at the one-month mark gets a progress report first.
When does the NIS2 24-hour deadline start?
When the entity becomes aware of the significant incident, not when the incident began. The 72-hour deadline runs from the same moment, so an incident notification is due 48 hours after an early warning sent at the 24-hour mark.
Do trust service providers have a shorter NIS2 deadline?
Yes. For significant incidents that have an impact on the provision of their trust services, trust service providers must send the incident notification within 24 hours of becoming aware, instead of 72 hours.
Do you have to tell customers about a NIS2 incident?
Where appropriate, you notify the recipients of your services without undue delay of significant incidents likely to adversely affect the provision of those services. For a significant cyber threat, where applicable, you tell potentially affected recipients what measures or remedies they can take, and where appropriate about the threat itself.
Can a company outside NIS2 report an incident voluntarily?
Yes. Article 30 lets any entity, in scope or not, voluntarily notify significant incidents, cyber threats and near misses. A voluntary notification does not impose obligations the entity would not otherwise have had.
