INDEPENDENT NIS2 RESOURCEGovernance · Resilience · ImplementationEU framework / national application
NIS2 ComplianceDigital · independent analysis Readiness index
Menu
HomeTimeline
Dates and reporting

Know which clock you are reading.

EU transposition milestones and incident reporting stages serve different purposes. National requirements and the facts of an incident determine the operational route.

24h

Early warning

Without undue delay and in any event within 24 hours after awareness of a significant incident.

72h

Notification

Without undue delay and in any event within 72 hours after awareness, with an initial assessment.

1 month

Final report

Generally no later than one month after the incident notification. Article 23 sets out further details.

EU framework milestone

Member States had until 17 October 2024 to transpose the Directive into national law. The state of national implementation varies, so consult the relevant authority for current law and reporting arrangements.

Build an incident decision record

Record the moment the organisation became aware, why the incident may be significant, affected services, who authorised a notification and which national channel was used.

Reporting obligations depend on scope, incident significance and national implementation. Do not use this overview as an incident response instruction.

Official sources and context

Use these alongside the applicable national legislation and authority guidance. This page is general information and may not reflect every national measure or later amendment.