Free tool · NIS2
NIS2 incident reporting deadline calculator
NIS2 Article 23: early warning within 24 hours, incident notification within 72 hours, final report within one month. Enter the moment you became aware of a significant incident to get each deadline in your own time zone.
NIS2, Article 23 deadlinesAware since:
| Report | Due by | Basis |
|---|---|---|
| Early warning | — | Art. 23(4)(a) |
| Incident notification | — | Art. 23(4)(b) |
| Final report | — | Art. 23(4)(d): one month after the notification (here: after a notification sent on its deadline) |
Copied. Paste them into your incident record.
What each report contains
- Early warning (24 hours). Whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have a cross-border impact.
- Incident notification (72 hours). An update of the early warning, an initial assessment of the incident with its severity and impact, and indicators of compromise where available.
- Intermediate report. Only if the CSIRT or competent authority asks for it.
- Final report (one month). A detailed description with severity and impact, the type of threat or root cause that likely triggered it, the mitigation measures applied and ongoing, and any cross-border impact. If the incident is still ongoing, you send a progress report instead, and the final report within one month after you have handled the incident.
Keep the evidence as you go
Each report builds on the previous one. Record the time you became aware, who decided the incident was significant and why, and what was sent and when. National transposition laws can add details or a specific form: check your CSIRT’s guidance.
This page helps you plan and document; it is not legal advice. Check the official text and your authority’s guidance. Source: Directive (EU) 2022/2555, Article 23. Related: CRA or NIS2: which reporting applies? and Clearlane Breach & Incident Reporting.