NIS2 Incident Reporting and Communications — Article 23

Article 23 of Directive (EU) 2022/2555 (NIS2), “Reporting obligations”, gives the obligations of essential entities and important entities for significant incidents and significant cyber threats. “This Directive is addressed to the Member States” (Article 46). Thus each obligation of an entity in the Directive applies to the entity through the national law transposing the Directive (Article 41(1)). Article 23 has this structure:

• Article 23(1) and (2): notification to the CSIRT or to the competent authority, and information for the recipients.
• Article 23(3): the test for a significant incident.
• Article 23(4): the reports and their time limits.
• Article 23(5): the “response” of the CSIRT or of the competent authority.
• Article 23(6) to (11): the tasks of the authorities, of ENISA, and of the Commission.

NIS2 Articles 29 and 30 give the cybersecurity information-sharing arrangements and the voluntary notification. For the relevant entities of Implementing Regulation (EU) 2024/2690, that Regulation also gives criteria for a significant incident. For the relevant entities and the other function of that Regulation, see Article 21(5) on the cybersecurity measures section.

Article 23(1) — notification to CSIRT / authority and to recipients

NIS2 Article 23(1), first subparagraph, gives these obligations:

Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (significant incident). Where appropriate, entities concerned shall notify, without undue delay, the recipients of their services of significant incidents that are likely to adversely affect the provision of those services. Each Member State shall ensure that those entities report, inter alia, any information enabling the CSIRT or, where applicable, the competent authority to determine any cross-border impact of the incident. The mere act of notification shall not subject the notifying entity to increased liability.

The first subparagraph has 4 parts, and each part has a different function:

• Notification to the authority: in national law that transposes Article 23(1), the entity notifies each significant incident to the CSIRT or, where applicable, to the competent authority. The entity sends this notification in the reports of Article 23(4).
• Notification to the recipients: this obligation applies only “where appropriate”, and only for significant incidents “that are likely to adversely affect the provision of those services”.
• Cross-border information: in national law that transposes Article 23(1), the entity reports the information that lets the CSIRT or, where applicable, the competent authority find “any cross-border impact of the incident”.
• Protection: the last part gives a protection to the entity, not an obligation. “The mere act of notification” does not increase the liability of the entity.

The second subparagraph and the third subparagraph of Article 23(1) give obligations to the Member States. If an entity notifies the competent authority, the Member State makes sure that the competent authority “forwards the notification to the CSIRT upon receipt”. For a cross-border or cross-sectoral significant incident, Member States make sure that their single points of contact get the “relevant information” of Article 23(4) “in due time”.

Article 23(2) — information for recipients about a significant cyber threat

NIS2 Article 23(2) gives an obligation for significant cyber threats. This obligation is different from the obligations for significant incidents:

Where applicable, Member States shall ensure that essential and important entities communicate, without undue delay, to the recipients of their services that are potentially affected by a significant cyber threat any measures or remedies that those recipients are able to take in response to that threat. Where appropriate, the entities shall also inform those recipients of the significant cyber threat itself.

The obligation applies “where applicable”. It applies to the recipients that are “potentially affected by a significant cyber threat”. The entity tells them the “measures or remedies” that they can use. “Where appropriate”, the entity also tells those recipients about the significant cyber threat. In Article 6(11), a significant cyber threat is “a cyber threat which, based on its technical characteristics, can be assumed to have the potential to have a severe impact on the network and information systems of an entity or the users of the entity’s services by causing considerable material or non-material damage”.

Article 23(3) — when an incident is "significant"

NIS2 Article 23(3) gives the test for a significant incident of an essential entity or an important entity:

An incident shall be considered to be significant if:

(a) it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;

(b) it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

In Article 6(6), an incident is “an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems”. Each point of Article 23(3) includes an incident that “is capable of” the effect, and not only an incident that caused the effect. Recital 101 sets no obligation. In recital 101, the incidents to report are incidents that, “based on an initial assessment carried out by the entity concerned”, “could cause severe operational disruption of the services or financial loss for that entity or affect other natural or legal persons by causing considerable material or non-material damage”.

The Commission Implementing Regulation (EU) 2024/2690 applies directly to its relevant entities (Articles 1 and 16). The relevant entities are the types of entity in Article 1 of the Regulation that are also essential entities or important entities (recital 1). For the list, see Article 21(5) on the cybersecurity measures section. For these entities only, Article 3(1) of the Regulation gives criteria for a significant incident. An incident is a significant incident “where one or more of the following criteria are fulfilled”:

• (a) the incident “has caused or is capable of causing direct financial loss for the relevant entity that exceeds EUR 500 000 or 5 % of the relevant entity’s total annual turnover in the preceding financial year, whichever is lower”
• (b) the incident “has caused or is capable of causing the exfiltration of trade secrets as set out in Article 2 point (1), of Directive (EU) 2016/943 of the relevant entity”
• (c) the incident “has caused or is capable of causing the death of a natural person”
• (d) the incident “has caused or is capable of causing considerable damage to a natural person’s health”
• (e) “a successful, suspectedly malicious and unauthorised access to network and information systems occurred, which is capable of causing severe operational disruption”
• (f) the incident “meets the criteria set out in Article 4”, which is about recurring incidents
• (g) the incident “meets one or more of the criteria set out in Articles 5 to 14”, which give criteria for each type of relevant entity.

In Article 4 of the Regulation, incidents that are not significant incidents one by one are “one significant incident” when all of these criteria apply:

• They occurred “at least twice within 6 months”.
• They have “the same apparent root cause”.
• They “collectively meet the criteria set out in Article 3(1)(a)”.

“Scheduled interruptions of service and planned consequences of scheduled maintenance operations carried out by or on behalf of the relevant entities” are not significant incidents (Article 3(2)). Recital 31 of the Regulation helps relevant entities to know when they are “aware” of a significant incident. This occurs when, “after such initial assessment”, the entity has “a reasonable degree of certainty that a significant incident has occurred”.

Article 23(4) — reports and time limits

NIS2 Article 23(4) gives the reports that essential entities and important entities send for a significant incident, and their time limits:

Member States shall ensure that, for the purpose of notification under paragraph 1, the entities concerned submit to the CSIRT or, where applicable, the competent authority:

Each report, its time limit, and its point of Article 23(4):

Report	Time limit	Point of Article 23(4)
Early warning	“without undue delay and in any event within 24 hours of becoming aware of the significant incident”	(a)
Incident notification	“without undue delay and in any event within 72 hours of becoming aware of the significant incident”	(b)
Notification of a trust service provider, for significant incidents “that have an impact on the provision of its trust services”	“without undue delay and in any event within 24 hours of becoming aware of the significant incident”, which replaces point (b)	second subparagraph
Intermediate report	“upon the request of a CSIRT or, where applicable, the competent authority”	(c)
Final report	“not later than one month after the submission of the incident notification under point (b)”	(d)
Progress report, for an ongoing incident at the time of the final report	at the time of the final report	(e)
Final report for an ongoing incident	“within one month of their handling of the incident”	(e)

Article 23(4)(a) — early warning (24 hours)

(a) without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;

The period starts when the entity becomes “aware of the significant incident”. For relevant entities, see recital 31 of Implementing Regulation (EU) 2024/2690 in the Article 23(3) section.

Article 23(4)(b) — incident notification (72 hours)

(b) without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;

The period of point (b) also starts when the entity becomes “aware of the significant incident”.

Article 23(4), second subparagraph — trust service providers

The second subparagraph of NIS2 Article 23(4) gives a time limit of 24 hours to trust service providers:

By way of derogation from the first subparagraph, point (b), a trust service provider shall, with regard to significant incidents that have an impact on the provision of its trust services, notify the CSIRT or, where applicable, the competent authority, without undue delay and in any event within 24 hours of becoming aware of the significant incident.

The derogation replaces point (b) only. It applies only to significant incidents “that have an impact on the provision of its trust services”. The period of one month for the final report in point (d) starts with “the submission of the incident notification under point (b)”. The Directive does not identify when this period starts for a significant incident to which the second subparagraph applies.

Article 23(4)(c) — intermediate report

(c) upon the request of a CSIRT or, where applicable, the competent authority, an intermediate report on relevant status updates;

The entity sends an intermediate report only if the CSIRT or the competent authority tells the entity to send one.

Article 23(4)(d) — final report

(d) a final report not later than one month after the submission of the incident notification under point (b), including the following:

(i) a detailed description of the incident, including its severity and impact;

(ii) the type of threat or root cause that is likely to have triggered the incident;

(iii) applied and ongoing mitigation measures;

(iv) where applicable, the cross-border impact of the incident;

The period of point (d) starts at “the submission of the incident notification”. It does not start when the entity becomes “aware of the significant incident”.

Article 23(4)(e) — progress report for an ongoing incident

(e) in the event of an ongoing incident at the time of the submission of the final report referred to in point (d), Member States shall ensure that entities concerned provide a progress report at that time and a final report within one month of their handling of the incident.

Article 23(5) — “response” from the CSIRT or competent authority

NIS2 Article 23(5) gives obligations to the CSIRT and to the competent authority, not to the entity:

The CSIRT or the competent authority shall provide, without undue delay and where possible within 24 hours of receiving the early warning referred to in paragraph 4, point (a), a response to the notifying entity, including initial feedback on the significant incident and, upon request of the entity, guidance or operational advice on the implementation of possible mitigation measures. Where the CSIRT is not the initial recipient of the notification referred to in paragraph 1, the guidance shall be provided by the competent authority in cooperation with the CSIRT. The CSIRT shall provide additional technical support if the entity concerned so requests. Where the significant incident is suspected to be of criminal nature, the CSIRT or the competent authority shall also provide guidance on reporting the significant incident to law enforcement authorities.

The period for the “response” starts when the CSIRT or the competent authority receives the early warning. The limit of 24 hours applies only “where possible”.

Article 23(6) to (11) — tasks of the authorities, ENISA, and the Commission

NIS2 Article 23(6) to (11) give tasks to the authorities, to ENISA, and to the Commission:

• Article 23(6) — “Where appropriate, and in particular where the significant incident concerns two or more Member States”, the CSIRT, the competent authority, or the single point of contact tells the “other affected Member States” and ENISA, “without undue delay”. This information includes “the type of information received in accordance with paragraph 4”. The CSIRT, the competent authority, or the single point of contact must keep “the entity’s security and commercial interests as well as the confidentiality of the information provided”.
• Article 23(7) — the CSIRT of a Member State or, “where applicable”, its competent authority can, “after consulting the entity concerned”, “inform the public about the significant incident or require the entity to do so”. This applies “where public awareness is necessary to prevent a significant incident or to deal with an ongoing significant incident, or where disclosure of the significant incident is otherwise in the public interest”. “Where appropriate”, the CSIRTs or the competent authorities of “other Member States concerned” can also do this.
• Article 23(8) — the single point of contact sends the notifications of Article 23(1) to the single points of contact of the “other affected Member States”. It does this “at the request of the CSIRT or the competent authority”.
• Article 23(9) — the single point of contact sends ENISA “a summary report” “every three months”. The summary report includes “anonymised and aggregated data on significant incidents, incidents, cyber threats and near misses notified in accordance with paragraph 1 of this Article and with Article 30”. ENISA can make “technical guidance” for the summary report. ENISA tells the Cooperation Group and the CSIRTs network about the results of its work on notifications “every six months”.
• Article 23(10) — the CSIRTs or the competent authorities give information to “the competent authorities under Directive (EU) 2022/2557”. This is the information in the notifications of Article 23(1) and Article 30 from “entities identified as critical entities under Directive (EU) 2022/2557”.
• Article 23(11) — Article 23(11) has 4 subparagraphs about the implementing acts of the Commission.

The 4 subparagraphs of Article 23(11) give these rules:

• The Commission can adopt implementing acts on “the type of information, the format and the procedure” of a notification of Article 23(1) and Article 30. These implementing acts can also apply to a communication of Article 23(2).
• “By 17 October 2024”, the Commission must adopt implementing acts “further specifying the cases in which an incident shall be considered to be significant”. These implementing acts are for a closed group of types of entity, which the second subparagraph of Article 23(11) gives. The Commission can adopt such implementing acts for other essential entities and important entities.
• The Commission works with the Cooperation Group on the “draft implementing acts” (Article 14(4), point (e)).
• The “examination procedure referred to in Article 39(2)” applies.

The second subparagraph of Article 23(11) names these types of entity: DNS service providers, TLD name registries, cloud computing service providers, and data center service providers. It also names content delivery network providers, managed service providers, and managed security service providers. It also names the “providers of online marketplaces, of online search engines and of social networking services platforms”. The Commission used Article 21(5), first subparagraph, and Article 23(11), second subparagraph, to make Implementing Regulation (EU) 2024/2690. That Regulation also applies to trust service providers (Article 1, recital 2), which the second subparagraph of Article 23(11) does not name.

The entity gives cross-border information at 3 times:

• In the information of Article 23(1), first subparagraph.
• In the early warning, where applicable (Article 23(4), point (a)).
• In the final report, which gives “where applicable, the cross-border impact of the incident” (Article 23(4), point (d)).

Articles 29 and 30 — cybersecurity information-sharing arrangements and voluntary notification

In NIS2 Chapter VI (“Information sharing”), Article 29 is about cybersecurity information-sharing arrangements. It gives obligations to the Member States, to ENISA, and to essential entities and important entities. Article 30 is about voluntary notification. It gives obligations to the Member States, to the CSIRTs, and to the competent authorities.

In Article 29(1) and (2), the Member States make sure that entities in the scope of NIS2 and, “where relevant”, other entities “are able to exchange on a voluntary basis relevant cybersecurity information among themselves”. Article 29(1) applies to the “information sharing” of points (a) and (b):

• Point (a): it “aims to prevent, detect, respond to or recover from incidents or to mitigate their impact”.
• Point (b): it “enhances the level of cybersecurity”.

The “information sharing” occurs “within communities of essential and important entities, and where relevant, their suppliers or service providers”, through cybersecurity information-sharing arrangements. The Member States help to set up these cybersecurity information-sharing arrangements (Article 29(3)), and ENISA also helps (Article 29(5)). Article 29(4) gives an obligation to notify the competent authorities, which applies through national law:

Member States shall ensure that essential and important entities notify the competent authorities of their participation in the cybersecurity information-sharing arrangements referred to in paragraph 2, upon entering into such arrangements, or, as applicable, of their withdrawal from such arrangements, once the withdrawal takes effect.

In Article 30(1), notifications can go to the CSIRTs or, where applicable, to the competent authorities, “on a voluntary basis”. These notifications are “in addition to the notification obligation provided for in Article 23”. 2 groups of entities can send them:

• Essential entities and important entities, about incidents, cyber threats, and near misses.
• Other entities, “regardless of whether they fall within the scope of this Directive”, about significant incidents, cyber threats, and near misses.

The Member States use the procedure of Article 23 for these notifications. They “may prioritise the processing of mandatory notifications over voluntary notifications” (Article 30(2)). A voluntary notification “shall not result in the imposition of any additional obligations upon the notifying entity to which it would not have been subject had it not submitted the notification”. This rule is “without prejudice to the prevention, investigation, detection and prosecution of criminal offences” (Article 30(2)). A voluntary notification of Article 30 does not replace the reports of Article 23. A notification of Article 29(4) also does not replace them.

The Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, changes Article 30(1) in its Article 6. As of October 2026, the Digital Omnibus is not law. In the proposal, voluntary notifications go “via the single-entry point established pursuant to Article 23a”. For the other changes of this proposal, see the next section.

NIS2 Article 23 and the reporting obligations of other EU laws

Other EU laws also have reporting obligations for incidents. For one incident, an entity can have an obligation to report in NIS2 Article 23 and an obligation to report in a different EU law:

• Cyber Resilience Act — Article 14 of Regulation (EU) 2024/2847 applies from 11 September 2026 (Article 71(2)). It tells the “manufacturer” to notify each “actively exploited vulnerability contained in the product with digital elements that it becomes aware of”. It also tells the “manufacturer” to notify each “severe incident having an impact on the security of the product with digital elements that it becomes aware of”. The “manufacturer” notifies the “CSIRT designated as coordinator” and ENISA (Article 14(1) and (3)). See Cyber Resilience Act Article 14.
• DORA — for financial entities identified as essential or important entities “pursuant to national rules transposing Article 3” of NIS2, DORA is a sector-specific Union legal act for NIS2 Article 4 (DORA Article 1(2)). Where NIS2 Article 4 applies, recital 28 of NIS2 tells Member States that the DORA provisions on “major ICT-related incident reporting” “should apply instead of those provided for in this Directive”. See Article 4 on the scope section and NIS2 and DORA.
• GDPR — an infringement of NIS2 Article 21 or 23 “can entail a personal data breach” that the GDPR tells the “controller” to notify (GDPR Article 33). If the competent authorities find this during supervision or enforcement, they tell the GDPR supervisory authorities “without undue delay” (NIS2 Article 35(1)). See Article 35 on the supervision and enforcement section.

Article 6 of the Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, also changes NIS2. It changes Article 23(1) and adds an Article 23(12) and an Article 23a. As of October 2026, COM(2025) 837 is not law.

The Commission proposal COM(2026) 13 of 20 January 2026 adds a different Article 23(12) and an Article 23(13) about ransomware attacks. As of October 2026, COM(2026) 13 is not law.

Each proposal has a different Article 23(12). For the 2 proposals, see the NIS2 proposals section.

Article 23 in Modulos

In Modulos, the Organization Framework OFF-15 "NIS2" and the AI System Framework MFF-15 "NIS2" contain Requirements for Article 23. OFF-15 also contains Requirements for Articles 29(4) and 30. NIS2 does not divide the reporting obligations between these 2 levels. Modulos divides them. For the Requirement of each provision, see Requirements of the NIS2 Frameworks.

Article 23 and ISO/IEC 27001, DORA, and the EU AI Act

Below, we compare NIS2 Article 23 with ISO/IEC 27001:2022, DORA, and the EU AI Act, and give the provision of each. The rows do not show that the instruments are equivalent. For financial entities, in some conditions, the DORA rules apply and NIS2 Article 23 does not apply (see Article 4 on the scope section).

For the EU AI Act, the rules below apply to “Providers of high-risk AI systems placed on the Union market”. They report to “the market surveillance authorities of the Member States where that incident occurred” (Article 73(1)). For some of these AI systems, Article 73(9) and (10) limit the notification to the incidents of Article 3, point (49)(c). For “high-risk AI systems which are safety components of devices, or are themselves devices, covered by Regulations (EU) 2017/745 and (EU) 2017/746”, the notification goes to “the national competent authority chosen for that purpose by the Member States where the incident occurred” (Article 73(10)). See EU AI Act Article 73.

NIS2 Article 23	ISO/IEC 27001:2022	DORA (Regulation (EU) 2022/2554)	EU AI Act (Regulation (EU) 2024/1689)
Significant incident (Article 23(3))	Annex A 5.25 (Assessment and decision on information security events)	Article 18 “Classification of ICT-related incidents and cyber threats”, with the Commission Delegated Regulation (EU) 2024/1772	Article 3, point (49), “serious incident”
Early warning and incident notification (Article 23(4), points (a) and (b))	Annex A 5.24 (Information security incident management planning and preparation)	Article 19(1) and (4): “initial notification” and “intermediate report”. In the Commission Delegated Regulation (EU) 2025/301, Article 5(1), point (a), the general time limit for the initial notification is “as early as possible, but in any case, within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours from the moment the financial entity has become aware of the ICT-related incident”. Article 5(2) applies where the financial entity “has not classified an ICT-related incident as major within 24 hours from the moment the financial entity has become aware” of it but “classifies that ICT-related incident as major at a later stage”. Then the financial entity sends the initial notification “within four hours from the classification of the ICT-related incident as a major incident”. Article 5(4) to (6) give conditions for “a weekend day or a bank holiday”. The Commission Implementing Regulation (EU) 2025/302 gives the “standard forms, templates, and procedures”	Article 73(2): the “provider” reports a “serious incident” “immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident”. Article 73(3): for “a widespread infringement or a serious incident as defined in Article 3, point (49)(b)”, the “provider” reports “immediately, and not later than two days after the provider or, where applicable, the deployer becomes aware of that incident”. Article 73(4): for “the death of a person”, the “provider” reports “immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident, but not later than 10 days after the date on which the provider or, where applicable, the deployer becomes aware of the serious incident”
Final report (Article 23(4), point (d))	Annex A 5.27 (Learning from information security incidents)	Article 19(4), point (c): “final report”. In the Commission Delegated Regulation (EU) 2025/301, Article 5(1), point (c), the time limit for the final report is “no later than one month after either the submission of the intermediate report, or, where applicable, after the latest updated intermediate report”	Article 73(5): “an initial report that is incomplete, followed by a complete report”
Recipients (Article 23(1) and (2))	Not compared	Article 19(3): the financial entity tells its “clients” about a “major ICT-related incident” that “has an impact on the financial interests of clients”. For a significant cyber threat, “where applicable”, it tells the “clients” “that are potentially affected” about “any appropriate protection measures”	Not compared
Information for the “public” (Article 23(7))	Not compared	Not compared	Not compared
Voluntary notification (Article 30)	Not compared	Article 19(2): a financial entity can notify “significant cyber threats” “on a voluntary basis”	Not compared

Where to go next

NIS2 overview

The dates of NIS2 and the proposals to change NIS2

Supervision and enforcement

Supervision and enforcement by the competent authorities, and the administrative fines of NIS2

Scope and applicability

Who NIS2 applies to, essential entities and important entities, Article 4 and DORA, and jurisdiction

Cybersecurity measures (Article 21)

Management bodies, the Article 21 measures, and Implementing Regulation (EU) 2024/2690

Operationalizing in Modulos

The two NIS2 Frameworks, the decisions before set-up, the steps, and the Requirements

NIS2 vs DORA

The NIS2 and DORA rules for financial entities, side by side

Sources

• NIS2 — Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 “on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)”. OJ L 333, 27.12.2022, p. 80. Provisions: Articles 4(1), 6(6), 6(11), 8(1), 10(1), 23, 29, and 30. Also Articles 32(4), 33(4), 35(1), 41(1), and 46, and recitals 28 and 101. EUR-Lex.
• Implementing Regulation (EU) 2024/2690 of the Commission of 17 October 2024, OJ L, 2024/2690, 18.10.2024: Articles 1, 3, 4, 5 to 14, and 16, and recitals 1, 2, and 31. EUR-Lex.
• Cyber Resilience Act — Regulation (EU) 2024/2847: Articles 14(1), 14(3), and 71(2). EUR-Lex.
• DORA — Regulation (EU) 2022/2554: Articles 1(2), 18, and 19. EUR-Lex.
• Delegated Regulation (EU) 2024/1772 of the Commission of 13 March 2024, for the DORA “classification of ICT-related incidents and cyber threats”. EUR-Lex.
• Delegated Regulation (EU) 2025/301 of the Commission of 23 October 2024, for the time limits of the DORA reports: Article 5. EUR-Lex.
• Implementing Regulation (EU) 2025/302 of the Commission of 23 October 2024, for the “standard forms, templates, and procedures” of the DORA reports. EUR-Lex.
• EU AI Act — Regulation (EU) 2024/1689, consolidated version of 27 July 2026: Article 3, point (49), and Article 73(1) to (5), (9), and (10). EUR-Lex.
• ISO/IEC 27001:2022: Annex A 5.24, 5.25, and 5.27.
• Digital Omnibus proposal — European Commission, COM(2025) 837 of 19 November 2025: Article 6. EUR-Lex.
• Proposal to change NIS2 — European Commission, COM(2026) 13 of 20 January 2026: Article 1, point (8). EUR-Lex.

Disclaimer

This page gives general information. It is not legal advice.

NIS2 applies in each Member State through the national law transposing it. Member States designate their CSIRTs and their competent authorities, and national law can also set the procedure for notifications. The Implementing Regulation (EU) 2024/2690 applies directly to its relevant entities. Before you make a decision, read NIS2 on EUR-Lex and the national law, and get legal advice.