What is the NIS2 incident reporting deadline (24h, 72h, 1 month)?
NIS2 Article 23 sets three deadlines for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours with an initial assessment, and a final report within one month of that notification. Reports go to your national CSIRT or competent authority.
Last updated: 2026-09-30
The three stages
| Stage | Deadline | What it contains |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Whether the incident is suspected to be malicious and whether it could have cross-border impact |
| Incident notification | Within 72 hours of becoming aware | Update of the early warning, initial assessment of severity and impact, indicators of compromise where available |
| Final report | Within one month of the notification | Detailed description, root cause, mitigation applied and any cross-border impact |
The authority can also request intermediate status updates. If the incident is still ongoing after one month, a progress report is due, with the final report following once it is handled.
What makes an incident "significant"
- ▸It has caused or can cause severe operational disruption of the service or financial loss for the entity, or
- ▸It has affected or can affect other people by causing considerable material or non-material damage.
Depends on national law: Reporting channels, forms and the receiving body (CSIRT or competent authority) are defined nationally.
Related question
When does the 24-hour NIS2 clock start?
From the moment the entity becomes aware of the significant incident — not from when the incident started. Having a documented detection and escalation process is what makes the deadline achievable.
Next steps
- NIS2 reporting deadlines in detail →
- Find your national CSIRT by country →
- Incident reporting workflow (Pro plan) →
More answers:
For decision-support purposes only, not legal advice. Exact obligations depend on national transposition — use our free scope checker for a personalised assessment.