What is a "significant incident" under NIS2?

Article 23(3) provides the primary definition. An incident is significant if it:

Who do you notify under NIS2?

The primary recipient of NIS2 incident notifications is the national CSIRT (Computer Security Incident Response Team). Each Member State designates one or more CSIRTs under Article 10 of NIS2. In several countries the CSIRT function is integrated with the national competent authority (NCA).

What if you are unsure whether the incident is significant?

This is the most common operational question that compliance and security teams face in the first hours of an incident. The NIS2 framework resolves the ambiguity decisively in favour of early notification.

What happens if you miss the 24-hour early warning deadline?

Missing the 24-hour deadline is itself an infringement of Article 23, independent of whether the underlying incident causes harm. National competent authorities may impose administrative fines for procedural non-compliance — several Member State regulators have signalled that reporting timeliness will be a primary enforcement focus in the first years of NIS2 supervision. The fine for missing the deadline may be lower than the fine for substantive ICT risk management failures, but it is a separate, cumulative liability. Document your awareness timeline carefully: the moment a significant incident is first suspected should be logged with a timestamp, as this anchors your 24-hour calculation.

Does the 24-hour rule apply to important entities as well as essential entities?

Yes. Article 23 applies to both essential and important entities without distinction. The reporting timelines — 24 hours, 72 hours, one month — are identical for both categories. The difference between essential and important entities lies in the supervisory approach (ex ante versus ex post) and the penalty ceiling, not in the substantive obligations. Both must have incident reporting procedures in place before 17 October 2024, covering the full three-stage NIS2 notification cycle.

Can reports be submitted in English or must they be in the national language?

This is determined by the Member State, not by NIS2 itself, which is silent on reporting language. Most Member States accept or prefer reports in their national language, though several (including the Netherlands, Sweden and Estonia) accept English submissions. For cross-border incidents with potential impact in multiple Member States, CSIRTs may coordinate through the EU-CyCLONe network and ENISA's ISAC structures, where English is the working language. Check your national CSIRT's reporting portal for language requirements — this is not something to discover for the first time during an active incident.

How does NIS2 reporting interact with GDPR Article 33 (72 hours)?

The two regimes operate independently but are frequently triggered simultaneously. When a NIS2 significant incident also involves a personal data breach, you must file the NIS2 early warning (24h) to your CSIRT and the GDPR Article 33 notification (72h) to your DPA — separately, with different content requirements and different recipients. The NIS2 early warning does not satisfy the GDPR obligation, and vice versa. Some Member States are developing coordinated notification portals to reduce administrative burden, but these are not yet universally available. Until they are, treat the two obligations as parallel tracks requiring separate management.

Are there reporting templates from ENISA for the 24-hour early warning?

Yes. ENISA published standardised reporting forms in its NIS2 Incident Reporting Guidelines (2024), covering all three stages of the notification cycle. The templates are not legally mandatory — entities may use their own format provided the required information is included — but the ENISA templates are recommended as they are designed to meet the content requirements of Article 23 and reduce the risk of submitting incomplete notifications. National competent authorities may publish their own variants; check your national CSIRT's website for jurisdiction-specific forms.

What penalties apply for late or incomplete NIS2 incident reporting?

The general NIS2 penalty regime applies: up to €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% of global annual turnover for important entities. However, Member States have discretion to calibrate fines within these maxima and are expected to apply proportionality. In practice, first-time procedural failures (such as a delayed 24-hour early warning during a genuine crisis) are likely to attract supervisory guidance or a formal warning rather than the maximum fine, particularly where the entity can demonstrate good-faith efforts and subsequent remediation. Repeated or systemic failures — or a failure to report at all — carry higher enforcement risk. Several national regulators have published enforcement frameworks setting out the factors they will weigh, including the severity of the incident, the entity's prior compliance record, and the quality of remediation.

RegTech

NIS2 Notificación de Incidentes: La Regla de 24 Horas Explicada (2026)

IgeraSolutions Compliance Team

15 de junio de 2026

9 min read

Cybersecurity incident response team working on NIS2 24-hour early warning notification

#NIS2 incident reporting 24 hours#NIS2 Article 23 notification#NIS2 early warning obligation#NIS2 significant incident reporting timeline#CSIRT notification NIS2 2025

COMPARTIR

Comparte el conocimiento con tu red

NIS2 Notificación de Incidentes: La Regla de 24 Horas Explicada (2026)

COMPARTIR

Artículos relacionados

DORA para Entidades Financieras: Guía Práctica de Cumplimiento 2026

NIS2 y Seguridad de la Cadena de Suministro: Obligaciones para Empresas EU