← Back to Blog

NIS2 Incident Reporting in 2026: The 24-Hour Rule Every CISO Will Trip Over

NIS2 incident reporting is where compliance programs fall apart. Here is the practical 24-hour, 72-hour, and one-month workflow security teams need before the next material incident lands.

---

---

Why this trips CISOs up

Most write-ups of NIS2 incident reporting compress it into a single soundbite — “you have 24 hours to report.” That is only true of the first of three distinct obligations under Article 23(4) of the Directive. Each one has a different name, a different deadline, a different anchor point for that deadline, and a different amount of detail expected in it. Teams that build a single 24-hour playbook and stop there are compliant with a step that does not exist and non-compliant with the two steps that do.

The clock for all of these starts the moment the entity becomes aware of a significant incident, not when the incident began and not when it is fully understood. That distinction matters operationally: detection and triage timestamps, not root-cause timestamps, are what a competent authority will use to check whether a deadline was met.

The three obligations, in the order the Directive actually requires them

1. Early warning — within 24 hours

Under Article 23(4)(a), essential and important entities must submit an early warning to their CSIRT or competent authority “without undue delay and in any event within 24 hours of becoming aware of the significant incident.” Where relevant, the early warning states whether the incident is suspected to result from unlawful or malicious acts, and whether it could have a cross-border impact. It is a flag, not a forensic report.

One narrow exception: trust service providers face a 24-hour deadline for both the early warning and the fuller notification step below — the Directive's second subparagraph to Article 23(4) removes the 72-hour option for that category with respect to incidents affecting their trust services.

2. Incident notification — within 72 hours

Article 23(4)(b) requires a fuller incident notification “without undue delay and in any event within 72 hours of becoming aware of the significant incident.” This step updates the 24-hour early warning and adds an initial assessment: severity, impact, and, where available, indicators of compromise. It is still an early-stage assessment, not the final account of what happened.

Under Article 23(5), the receiving CSIRT or competent authority is separately expected to acknowledge the early warning and give initial feedback to the reporting entity “without undue delay and where possible within 24 hours” of receiving it — a reciprocal timing obligation that sits on the regulator's side, not the entity's.

3. Intermediate report — only on request

This is the step most compliance checklists get wrong by inventing a fixed deadline for it. Article 23(4)(c) does not set a calendar deadline at all: an intermediate report on relevant status updates is owed only “upon the request of a CSIRT or, where applicable, the competent authority.” If the authority does not ask for one, there is no separate intermediate-report deadline to track.

4. Final report — one month after the 72-hour notification

Article 23(4)(d) requires a final report “not later than one month after the submission of the incident notification under point (b)” — i.e. one month after the 72-hour notice, not one month after the incident occurred or was discovered. The final report must include a detailed description of the incident and its severity/impact, the likely threat type or root cause, mitigation measures applied and ongoing, and any cross-border impact.

If the incident is still ongoing when that one-month deadline arrives, Article 23(4)(e) requires a progress report at that point, followed by a final report within one month of when the entity actually finishes handling the incident. The final-report clock can move, in other words, but only for incidents that are demonstrably still active.

Stage	Deadline	Anchor point	Directive text
Early warning	24 hours	Becoming aware of the significant incident	Art. 23(4)(a)
Incident notification	72 hours	Becoming aware of the significant incident	Art. 23(4)(b)
Intermediate report	No fixed deadline	Regulator's request	Art. 23(4)(c)
Final report	1 month	Submission of the 72-hour notification	Art. 23(4)(d)
Progress + final report (if still ongoing)	1 month	Completion of incident handling	Art. 23(4)(e)

What counts as “significant” enough to report

Not every incident triggers Article 23. Under Article 23(3), an incident is significant if it (a) has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or (b) has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. Entities also have to consider cross-border impact when they report, so their CSIRT or competent authority can determine whether other Member States need to be looped in.

Who this applies to

NIS2 splits regulated organizations into essential and important entities (Article 3). In broad terms: medium and large organizations in the sectors listed in the Directive's Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, and public administration, among others) are essential entities, while medium and large organizations in the Annex II sectors (postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research, among others) are important entities by default. A handful of categories — qualified trust service providers, TLD registries, and DNS service providers — are essential entities regardless of size. Exact classification depends on each Member State's national transposition and the size thresholds set out in the EU's SME recommendation, so organizations should confirm their status with their national competent authority rather than inferring it from sector name alone.

The cost of getting the timeline wrong

Article 23 is not a soft obligation. Article 34 ties administrative fines directly to breaches of Article 21 (risk-management measures) or Article 23 (reporting obligations): essential entities face fines of up to at least €10,000,000 or 2% of total worldwide annual turnover, whichever is higher; important entities face up to at least €7,000,000 or 1.4% of turnover, whichever is higher. Missing the 24-hour or 72-hour deadline is, on its own, an Article 23 breach — independent of whatever caused the underlying incident.

A practical checklist

• Know your CSIRT/competent authority before you need it. The 24-hour clock starts at awareness, which leaves no time to figure out who to call.
• Separate the 24h and 72h playbooks. The early warning is a flag with minimal detail; the 72h notification requires an initial severity/impact assessment. Treating them as one step wastes the 24-hour window on work that belongs in the 72-hour one.
• Track the final-report deadline from the 72-hour submission date, not from the incident date or the detection date.
• Do not assume an intermediate report is required. It is request-driven, not calendar-driven — but be ready to produce one on short notice if your CSIRT asks.
• Log awareness timestamps as carefully as technical ones. Every deadline in Article 23(4) runs from “becoming aware,” and that timestamp is what a competent authority will check first.