NIS2 Incident Reporting: The 24-Hour Early Warning, 72-Hour Notification and Final Report

The duty binds organisations through the national law that transposes Article 23, because the Directive is addressed to the Member States (Article 46) and has applied through those laws since 18 October 2024 (Article 41(1)). How the law itself is built is explained under NIS2 Directive on the home page.

This page sets out the five reports with their deadlines and contents, the recipients, and how eight national laws implement the clock, followed by voluntary notification, late reports and the changes pending as of 23 October 2026.

Which Incidents Must Be Reported and by Whom

Essential and important entities must report each significant incident, meaning an incident that has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or considerable material or non-material damage to other natural or legal persons (Article 23(1) and (3)). The test covers potential as well as actual impact, so an incident can be significant before the damage is complete.

For the 11 entity types of Implementing Regulation (EU) 2024/2690, such as cloud computing, data centre and trust service providers, the Regulation fixes the thresholds. One criterion is a direct financial loss above EUR 500,000 or 5 % of total annual turnover in the preceding financial year, whichever is lower (Article 3(1)(a)). The Commission adopted that Regulation under the second subparagraph of Article 23(11) NIS2, and every other entity applies the Article 23(3) test through its national law to decide whether an incident is a significant incident.

Incidents that are not significant, cyber threats and near misses carry no reporting duty, but they may be notified voluntarily under Article 30. Incident reporting is one of four core duties, next to registration, management-body governance and the Article 21 risk-management measures, and all four are set out under NIS2 compliance requirements.

The Five Reports of Article 23(4) and Their Deadlines

Article 23(4) sets five reports for one significant incident: an early warning within 24 hours, an incident notification within 72 hours, an intermediate report on request, a final report one month after the notification and, where the incident is still ongoing, a progress report. Each report goes to the same CSIRT or competent authority, and Table 1 gives the deadline and the content of each one as the text of Article 23 on EUR-Lex sets them.

Table 1: the five reports of Article 23(4) of Directive (EU) 2022/2555; national laws can deviate, see Table 2.

Early Warning Within 24 Hours

The early warning is due without undue delay and in any event within 24 hours of becoming aware of the significant incident (Article 23(4)(a)). The 24 hours run in calendar hours, so a weekend or a public holiday does not pause them.

Where applicable, the early warning states whether the incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact, and nothing more is required at this stage. German law calls this first report the "frühe Erstmeldung" (early first report, § 32(1) BSIG).

Incident Notification Within 72 Hours

The incident notification is due without undue delay and in any event within 72 hours of becoming aware of the significant incident, and it updates the early warning (Article 23(4)(b)). Both clocks start at the same moment, so the notification follows the early warning by up to 48 hours, not by 72.

The notification gives an initial assessment of the significant incident, including its severity and impact, and the indicators of compromise where they are available. It does not close the duty: the final report follows one month later.

Intermediate and Progress Reports

An intermediate report is sent only when the CSIRT or competent authority asks for relevant status updates (Article 23(4)(c)). Without such a request, the entity moves from the incident notification straight to the final report.

A progress report takes the place of the final report on its due date when the incident is still ongoing at that point (Article 23(4)(e)). The final report then follows within one month of the handling of the incident, so a long-running incident produces a notification, a progress report and a later final report.

Final Report One Month After the Notification

The final report is due not later than one month after the submission of the incident notification (Article 23(4)(d)). The month runs from the day the notification was actually submitted, not from the day of the incident.

The final report contains four elements: a detailed description of the incident, including its severity and impact; the type of threat or root cause; the applied and ongoing mitigation measures; and, where applicable, the cross-border impact of the incident. It is the only one of the five reports that requires a root-cause statement.

When the Clock Starts: Becoming Aware

The 24-hour and 72-hour clocks run from the moment the entity becomes aware, which Implementing Regulation (EU) 2024/2690 (recital 31) places after an initial assessment that gives a reasonable degree of certainty that a significant incident has occurred. The clocks therefore start with the result of that initial assessment, not with the first technical alert.

In a worked example, an entity that becomes aware on Tuesday at 10:00 sends the early warning by Wednesday at 10:00 and the incident notification by Friday at 10:00. Its final report falls due one calendar month after the day the notification was actually submitted, which can be earlier than that Friday. The German BSI links becoming aware ("Kenntniserlangung") to an employee gaining knowledge during working time ("innerhalb der Arbeitszeit"), which is guidance, not statute.

Trust Service Providers: 24 Hours for the Notification

Trust service providers send the incident notification within 24 hours instead of 72 hours for significant incidents that affect the provision of their trust services (Article 23(4), second subparagraph). The early warning and the final report follow the same rules as for every other entity, so for these providers the early warning and the notification fall due within the same 24 hours. Austria, Belgium and Cyprus restate this 24-hour rule in their national laws (Table 2).

Who Receives the Reports and What Happens Next

Every report goes to the entity's CSIRT or, where the Member State provides for it, to its competent authority, which forwards it to the CSIRT; ENISA and the Commission do not receive an entity's report (Article 23(1)).

Each Member State designates its own CSIRTs and competent authorities, so the recipient follows from the national law. The bodies of each Member State are listed under NIS2 authorities.

Article 23 sets four follow-up steps once a report arrives, listed below.

• CSIRT feedback (Article 23(5)): the CSIRT or competent authority gives initial feedback without undue delay and, where possible, within 24 hours of the early warning (a target, not a binding deadline), plus guidance on reporting to law enforcement where a criminal nature is suspected.
• Public information (Article 23(7)): the CSIRT or competent authority may, after consulting the entity, inform the public or require the entity to do so.
• Summary to ENISA (Article 23(9)): the single point of contact sends ENISA an anonymised, aggregated summary every three months, and ENISA reports its findings every six months.
• CER information (Article 23(10)): information on incidents notified by critical entities under the CER Directive is passed to the CER authorities.

Informing the Recipients of the Service

An entity also notifies the recipients of its services, without undue delay and where appropriate, of a significant incident that is likely to adversely affect the provision of those services (Article 23(1)). In Germany this notice is given on order of the BSI and may take the form of a notice on the entity's website (§ 35(1) BSIG).

For a significant cyber threat (defined in Article 6(11)), the entity communicates to potentially affected recipients the measures or remedies they can take and, where appropriate, the threat itself (Article 23(2)). Article 23(1) also protects the reporting entity: "the mere act of notification shall not subject the notifying entity to increased liability".

Incidents with a Cross-Border Impact

An entity reports any information that lets the CSIRT or competent authority determine whether the incident has a cross-border impact (Article 23(1)). Where appropriate, the CSIRT, the competent authority or the single point of contact informs the other affected Member States and ENISA (Article 23(6)). The single point of contact also forwards notifications to the single points of contact concerned (Article 23(8)), so the entity reports once, nationally, and the cross-border exchange runs between authorities.

How National Laws Implement the Reporting Clock

The eight national laws in Table 2 keep the staged structure of Article 23, but Cyprus shortens the early warning to 6 hours, Portugal and Czechia set different final-report periods, and each Member State names its own recipient and channel. Table 2 covers Germany, Austria, Belgium, Italy, Cyprus, Portugal, Czechia and Poland, and the status of each national law is tracked in the NIS2 transposition tracker.

Table 2: national implementation as of 23 October 2026; values from the national acts named; other Member States are not covered by this table.

Cyprus keeps the 72-hour notification but leaves a quarter of the EU period for the first report. Portugal counts its final report in working days from the end of the significant impact, and an incident resolved within 2 hours needs only the end-of-impact notification (RJC Article 44(1)).

Three laws add steps of their own. In Poland the sector CSIRT forwards each report within 8 hours (Article 26(1a) KSC). Belgium also sends the notifications of essential entities to the National Crisis Centre (NCCN) (Article 34 § 1 and Article 35 § 3 of the Law of 26 April 2024). Italy classifies incidents as IS-1 (confidentiality), IS-2 (integrity), IS-3 (availability) and IS-4 (unauthorised access or abuse of privileges) under ACN Determinazione 379907/2025.

In Germany the reports go through the BSI portal, which requires prior registration and an ELSTER organisation certificate, and operators of critical facilities (Betreiber kritischer Anlagen) add details on the affected facility, the critical service and the impact (§ 32(3) BSIG). The BSI counted 1,272 initial NIS-2 reports and 3,070 NIS-2 reports in total by 30 September 2026 (BSI, NIS-2 in Zahlen). The German law as a whole is covered under NIS2 in Germany.

Voluntary Notification under Article 30

Essential and important entities may notify incidents, cyber threats and near misses on a voluntary basis, and any other entity, in scope or not, may notify significant incidents, cyber threats and near misses (Article 30(1)(a) and (b)). A voluntary notification does not result in any additional obligations that the entity would not have had without it (Article 30(2)).

A near miss is an event that could have compromised availability, authenticity, integrity or confidentiality but was successfully prevented from materialising or did not materialise (Article 6(5)). Two national laws in Table 2 add protections for voluntary reports: Austria allows anonymous voluntary reports (§ 37(3) NISG 2026), and in Belgium a voluntary report does not directly trigger an inspection under Article 44 (Article 38 § 2 of the Law of 26 April 2024). Separately, essential and important entities notify their competent authority when they join or leave a cybersecurity information-sharing arrangement (Article 29(4)).

What Happens When a Report Is Late or Missing

A late or missing report is an infringement of Article 23 for which the competent authority can order the entity to meet its reporting obligations in a specified manner and within a specified period (Article 32(4)(d) for essential entities, Article 33(4)(d) for important entities) and impose an administrative fine. Failure to notify or remedy significant incidents is among the serious infringements named in Article 32(7)(a).

Article 34 requires Member States to provide maximum fines of at least EUR 10,000,000 or 2 % of total worldwide annual turnover in the preceding financial year for essential entities (Article 34(4)) and of at least EUR 7,000,000 or 1.4 % for important entities (Article 34(5)), whichever is higher in each case. National caps differ, and how they work is set out under NIS2 fines.

NIS2 Reporting Pages: Significance Thresholds and Report Templates

Two pages go deeper into NIS2 incident reporting: the significance thresholds that decide whether an incident must be reported, and the templates that set what each report contains. Table 3 links both pages with the legal provisions each one explains.

Table 3: the two pages on NIS2 incident reporting below this hub.

Pending Changes to Incident Reporting as of 2026-10-23

As of 23 October 2026, Article 23 has not been amended, and three developments concern it: the common incident-reporting templates of the NIS Cooperation Group, the Digital Omnibus proposal COM(2025) 837 and the targeted NIS2 amendment proposal COM(2026) 13. The Commission announced on 26 May 2026 that the NIS Cooperation Group adopted common templates for incident reporting at its 39th plenary meeting in Cyprus, giving "a clear, uniform format for reporting cyber incidents" (Commission news). The Commission plans to make the templates mandatory through an implementing act, and they are not yet binding.

The Digital Omnibus COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)) would create a single entry point for incident reporting. The European Parliament's joint ITRE and LIBE committees are at "Awaiting committee decision", and Coreper agreed the Council's negotiating mandate on 21 October 2026. COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) would streamline the collection of ransomware data, and its lead committee ITRE is at "Awaiting committee decision". Both proposals are pending as of 23 October 2026 and are tracked under NIS2 amendments and review.

Until a proposal is adopted and transposed, the national law that transposes Article 23 governs every report.

How Incident Reporting Relates to Other Reporting Duties

One incident can trigger NIS2 reporting and other reporting duties at the same time, and each duty keeps its own recipient and clock. Three such duties are listed below.

• DORA reports of major ICT-related incidents by financial entities
• GDPR notifications of personal data breaches
• Cyber Resilience Act reports by manufacturers of products with digital elements

Manufacturers report actively exploited vulnerabilities and severe incidents under Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), which has applied since 11 September 2026; that duty is explained on cyberresilienceactguide.net.

Financial Entities under DORA

Financial entities covered by DORA report major ICT-related incidents under DORA instead of under Article 23, because DORA (Regulation (EU) 2022/2554) is the sector-specific act under Article 4 NIS2. It displaces the NIS2 rules on measures, reporting and supervision, while the national strategy (Article 7) and crisis management (Articles 9 and 16) still reach these entities.

The DORA initial notification is due within 4 hours of classification and no later than 24 hours after awareness, the intermediate report within 72 hours of it and the final report within one month (Delegated Regulation (EU) 2025/301, Article 5(1)). The overlap is compared under NIS2 vs DORA.

Personal Data Breaches: A Separate Notification

A significant incident that also involves a personal data breach needs a separate GDPR notification to the data protection authority without undue delay and, where feasible, within 72 hours (Article 33(1) of Regulation (EU) 2016/679).

NIS2 competent authorities inform the data protection authority (Article 35(1) NIS2), and no Article 34 NIS2 fine follows for conduct that the data protection authority has already fined under Article 58(2)(i) GDPR (Article 35(2) NIS2).

Handling an Incident Versus Reporting It

Reporting is the duty to inform the authority; handling is the Article 21(2)(b) measure, which covers the actions and procedures that prevent, detect, analyse and contain or respond to and recover from an incident (Article 6(8)). The final report draws on the root cause and mitigation that incident handling produces, and what the measure requires is explained under NIS2 incident handling.