What Is a Significant Incident under NIS2? Article 23(3) and the Thresholds of Regulation 2024/2690

Either limb suffices, and potential impact counts as much as actual impact.

The Directive binds Member States (Article 46), so an organisation applies the significance test as its national law transposes it. For 11 digital entity types, Implementing Regulation (EU) 2024/2690, directly applicable since 7 November 2024, turns the test into exact thresholds. The wider NIS2 Directive framework sets the scope in which this test operates.

Mandatory and voluntary reporting, the general criteria, recurring incidents, the per-type thresholds and national practice follow in that order, with a five-step assessment at the end.

How Does NIS2 Define a Significant Incident?

NIS2 does not list "significant incident" among the definitions of Article 6: the term is used in Article 23(1) and defined by the two alternative criteria of Article 23(3), points (a) and (b). Point (a) covers an incident that has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned. Point (b) covers an incident that has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. The EUR-Lex text of Directive (EU) 2022/2555 has not changed Article 23 as of 23 October 2026.

The test triggers the three reporting stages of Article 23(4), the 24-hour early warning, the 72-hour notification and the final report, which the parent page on NIS2 incident reporting deadlines covers. The French text of the Regulation calls a significant incident "incident important".

Which Events Must Be Reported and Which Are Voluntary?

Only significant incidents must be reported (Article 23(1)); other incidents, cyber threats and near misses may be reported voluntarily under Article 30(1)(a). An incident is an event compromising the availability, authenticity, integrity or confidentiality of data or services (Article 6(6)), and a near miss is an event that could have done so but was prevented or did not materialise (Article 6(5)). Entities outside the Directive's scope may report significant incidents, cyber threats and near misses voluntarily (Article 30(1)(b)), and voluntary reporting creates no additional obligations (Article 30(2)). Notification alone does not increase an entity's liability (Article 23(1)).

Actual or Potential Impact: What "Capable of Causing" Means

An incident is significant as soon as it is capable of causing the disruption, loss or damage, so the assessment weighs potential as well as actual impact. Article 3(1)(b) to (d) of Regulation (EU) 2024/2690 uses the same "caused or capable of causing" wording. The reporting clock starts when the entity, after an initial assessment, has a reasonable degree of certainty that a significant incident has occurred (recital 31 of the Regulation).

Assessment Indicators from Recital 101

Recital 101 of NIS2 names the indicators for the Article 23(3) assessment:

• the affected systems and their importance;
• the severity and technical characteristics of the threat;
• the exploited vulnerabilities;
• experience with similar incidents;
• the extent of the impact on the service;
• the duration of the incident;
• the number of affected recipients of the service.

A recital guides interpretation, and the national law decides how an entity applies it.

Which Significance Test Applies to Your Entity?

Three layers decide which significance test an entity applies: Article 23(3) for every essential and important entity, the exhaustive thresholds of Implementing Regulation (EU) 2024/2690 for 11 digital entity types, and national guidance where a Member State or its authority makes the test concrete.

The Commission adopted the Regulation on 17 October 2024 under the second subparagraph of Article 23(11), meeting the deadline of that date. Trust service providers are covered for coherence although Article 23(11) does not list them (recital 2). Readers find the act as a whole under Implementing Regulation (EU) 2024/2690 and its incident thresholds.

What Are the General Criteria for Digital Service Providers?

For the 11 digital entity types, Article 3(1) of Implementing Regulation (EU) 2024/2690 makes an incident significant when any one of seven criteria, points (a) to (g), is met.

• (a) a direct financial loss, covered in the next section;
• (b) the exfiltration of trade secrets within Article 2(1) of Directive (EU) 2016/943, caused or capable of being caused;
• (c) the death of a natural person, caused or capable of being caused;
• (d) considerable damage to a natural person's health, caused or capable of being caused;
• (e) successful, suspectedly malicious and unauthorised access capable of causing severe operational disruption, including pre-positioning (recital 39);
• (f) recurring incidents under Article 4;
• (g) the entity-type criteria of Articles 5 to 14.

The Financial Loss Threshold and Which Costs Count

An incident is significant under Article 3(1)(a) when it has caused or is capable of causing a direct financial loss above EUR 500,000 or 5 % of the entity's total annual turnover in the preceding financial year, whichever is lower. An entity with turnover of EUR 4,000,000 reaches 5 % at EUR 200,000, so that figure is its threshold. With turnover of EUR 20,000,000, 5 % is EUR 1,000,000 and the threshold stays at EUR 500,000 (calculated). The two limits meet at turnover of EUR 10,000,000 (calculated). Recital 36 lists the costs.

Scheduled Maintenance, User Counting and Duration

Scheduled interruptions and the planned consequences of scheduled maintenance are not significant incidents (Article 3(2)). Three further rules shape the counts:

• Users under Article 3(3) are customers with a contract granting access plus natural and legal persons associated with business customers; where the number cannot be calculated, the entity estimates the possible maximum (recital 32).
• Duration runs from the disruption of proper provision until recovery, or, if the start is unknown, from detection or the log record, whichever is earlier (recitals 34 and 35).
• Limited availability means a response time considerably slower than average or not all functionalities available (recital 38).

When Do Recurring Incidents Become Significant?

Incidents that are not significant one by one count as one significant incident under Article 4 of Implementing Regulation (EU) 2024/2690 when they have occurred at least twice within six months, share the same apparent root cause and together meet the financial criterion of Article 3(1)(a). Take an entity with turnover of EUR 4,000,000 and a threshold of EUR 200,000. Two incidents of EUR 150,000 and EUR 100,000 within four months, with the same apparent root cause, total EUR 250,000 (calculated) and so form one significant incident.

Point 3.4.2(b) of the Annex requires a quarterly check for recurring incidents, which belongs to incident handling under Article 21(2)(b).

Thresholds per Entity Type under Articles 5 to 14

Articles 5 to 14 of Implementing Regulation (EU) 2024/2690 add entity-type thresholds for unavailability, response time, data compromise and physical access, and meeting any one of them makes the incident significant. Where an article gives two user figures, the smaller applies, and users are counted under Article 3(3) for Articles 7 and 9 to 14. A cloud provider with 10,000,000 users in the Union reaches the limited-availability threshold at more than 500,000 affected users, which is 5 % and smaller than 1,000,000, for more than one hour (calculated).

How Do National Authorities Apply the Significance Test?

Outside the 11 digital types the test is Article 23(3) as transposed, and the three national practices in the table below show how authorities in Germany, Belgium and Italy make it concrete. The German statute uses the term "erheblicher Sicherheitsvorfall" (significant security incident), defined in § 2 No. 11 BSIG.

The national law binds the entity, and the Belgian values are Belgian indicators only, not rules for other Member States. The remaining Member States appear in the NIS2 transposition tracker.

How to Assess Significance in the First Hours

Prepare the significance decision before an incident happens, because the early warning is due within 24 hours of becoming aware.

1. Identify which test applies, using the table of significance tests above.
2. Pre-calculate the financial threshold from last year's turnover.
3. Keep user counts per service current.
4. Log every incident with its apparent root cause and check for recurrence each quarter.
5. Record the criterion met and the time of awareness, then report through the national channel.

What Follows Once an Incident Is Significant?

A significant incident starts the reporting stages of Article 23(4): an early warning within 24 hours of becoming aware, an incident notification within 72 hours (24 hours for trust service providers on incidents impacting their trust services), and a final report one month after the notification. Reports go to the CSIRT or, where applicable, the competent authority (Article 23(1)).

Where appropriate, the entity also informs recipients of its services without undue delay of significant incidents likely to adversely affect the provision of those services (Article 23(1)). The content of each stage is set out under what the early warning, notification and final report must contain.

Significant Incident Questions

Four questions recur about significant incidents under NIS2.

Does every cyberattack count as a significant incident?

No: an attack is significant only if it meets Article 23(3) or, for the 11 digital types, one criterion of Article 3(1) of Regulation 2024/2690. A successful, suspectedly malicious and unauthorised access capable of causing severe operational disruption is one such criterion.

Must an incident that was prevented be reported?

Not as a significant incident: an event that was prevented from materialising is a near miss (Article 6(5)), which entities may report voluntarily under Article 30(1)(a). An incident that did occur and was capable of causing severe impact stays significant even if the damage was contained.

Do the thresholds of Regulation 2024/2690 apply to hospitals or manufacturers?

No: the Regulation binds only the 11 digital entity types of its Article 1, so hospitals, manufacturers and every other sector apply Article 23(3) as transposed, with any national guidance. In Germany, the BSI uses the Article 3(1) criteria as an orientation for other sectors.

What happens if a significant incident is not reported?

Failing to notify a significant incident is a serious infringement under Article 32(7)(a), and Article 34 requires maximum fines of at least EUR 10,000,000 or 2 % of worldwide annual turnover, whichever is higher, for essential entities and at least EUR 7,000,000 or 1.4 %, whichever is higher, for important entities. National caps differ, as the page on NIS2 fines shows.