NIS2 early warning: what to do in the first 24 hours
Under NIS2, an essential or important entity has 24 hours, from the moment it becomes aware of a significant incident, to send an early warning to its CSIRT or competent authority. Here is what counts as significant, what the early warning must contain, and how to make the deadline without guessing.
The four reports of Article 23
- Early warning: within 24 hours of becoming aware of the significant incident.
- Incident notification: within 72 hours, updating the early warning with an initial assessment of severity and impact, and indicators of compromise where available.
- Intermediate report: whenever the CSIRT or authority asks for one.
- Final report: within one month of the incident notification, or a progress report at that date if the incident is still ongoing, then the final report within a month of handling it.
Our free NIS2 deadline calculator gives you the three dates from the moment you became aware.
Is the incident significant?
Article 23(3) calls an incident significant when it has caused, or is capable of causing, severe operational disruption of your services or financial loss, or when it has affected, or can affect, other people by causing considerable material or non-material damage. For some digital providers, an implementing regulation adds precise thresholds. When in doubt, the clock is what matters: record the decision and its reasons, with the time.
What the early warning must say
Very little, on purpose. The early warning says that a significant incident is under way and, where possible, whether it may have been caused by an unlawful or malicious act, and whether it may have a cross-border impact. You can also ask for help. The details come in the 72-hour notification.
A first-24-hours checklist
- Write down the moment of awareness, with the evidence that triggered it. Every deadline counts from there.
- Decide whether it is significant, and have the decision signed by the person in charge, with a named back-up.
- Send the early warning through the channel your country set up, then keep the proof of sending.
- Tell the recipients of your services when the incident is likely to affect them (Article 23(1)), and what they can do to protect themselves.
- Prepare the 72-hour notification: first assessment of severity and impact, indicators of compromise, measures taken.
Most late reports are not caused by the incident itself, but by nobody knowing who decides, or where the clock started. Settle those two points before the first incident.
Where Clearlane helps
Clearlane Breach & Incident Reporting keeps each incident in Jira with every legal deadline counted (NIS2, and the GDPR or DORA when they also apply), notification texts ready to paste and an evidence file with the signatures. It is designed to help you meet these deadlines; it submits nothing on your behalf, and the legal assessment remains yours.
Source: Directive (EU) 2022/2555 (NIS2), Article 23 and recitals 101-102. Checked on 22 October 2026. This guide is not legal advice.