- 2026-09-11
NIS2 sets a staged clock. An entity submits an early warning within 24 hours of becoming aware of a significant incident, then an incident notification with an initial assessment within 72 hours. A final report follows within one month of that notification. Every deadline runs from awareness.
What does each NIS2 reporting stage require?
Article 23 of Directive (EU) 2022/2555 separates notification into stages so that regulators receive a signal early and detail later. The early warning is deliberately thin. The 72-hour notification carries an initial assessment. The final report closes the file with the root cause and applied mitigation.
When does the NIS2 clock start?
The clock starts at awareness of a significant incident. Awareness is not the same as containment, and awareness is not the same as full understanding. An organisation that detects an intrusion nine days after it began has not gained nine extra days; the 24-hour window opens the moment the organisation knows a significant incident has occurred.
Why does coverage decide whether the 24-hour deadline is realistic?
This is where the reporting obligation stops being a legal question and becomes a staffing question. If detection lands at 02:00 local time and the security team works Central European Time business hours, a large part of the first window is gone before anyone triages the alert. For detection and response staffing that operates inside these timelines, see our cybersecurity services.
A team anchored in Central European Time gives working-hours overlap with the whole European Union, plus a handover into United States hours. Confirming that an incident is significant and preparing the early warning then happen close together, rather than at next-morning login. Winged IT staffs security teams on this model for clients across Europe, the United States, and Asia, and near-continuous coverage is what makes the 24-hour early warning realistic rather than aspirational.
What has to exist before an incident for the first deadline to hold?
Three things, all of them decided in advance. Detection, including operational readiness audits, helps identify significant events rather than focusing solely on the number of alerts. A named person authorised to file without convening a committee. A written rule for what counts as significant. Teams that improvise the third item during an incident lose most of the first day to internal debate.
Who receives the NIS2 report?
Each member state designates its own competent authority and computer security incident response team, so the recipient depends on the country of establishment. NIS2 also places accountability for cybersecurity risk management on senior management, which locates the reporting duty within governance rather than inside the technology function.
NIS2 implementation varies by member state and by entity classification. This text describes the reporting mechanism set out in Article 23 and is not legal advice. Confirm your own obligations with qualified legal counsel. Wider regulatory picture in the pillar article on cybersecurity regulation across Europe.
