Guides › NIS2 reporting obligations
NIS2 reporting obligations: who must report what, and when.
If you fall under NIS2, you must report significant incidents within fixed deadlines to the competent authority (in Germany the BSI), with the first notification due after just 24 hours. This guide explains when an incident must be reported, which notifications are due and how to prepare so that nobody has to improvise when it happens.
When an incident must be reported.
Not every incident must be reported, only a significant incident. An incident is significant if it has, or can have, at least one of these consequences:
Severe operational disruption
The incident has caused, or can cause, significant disruption to your services.
Financial loss
The incident has caused, or can cause, noticeable financial losses for you.
Damage to third parties
Other people or companies are, or could be, affected by considerable material or non-material damage.
For certain digital services, such as cloud providers, data centres and managed service providers, EU Implementing Regulation 2024/2690 sets more precise thresholds. You decide whether an incident is significant on a case-by-case basis and should document your reasoning. This guide does not constitute legal advice.
Four notifications, three fixed deadlines.
The deadlines run from the moment you become aware of the significant incident, not from the moment it occurred. Notifications go to the competent authority or CSIRT, in Germany the BSI.
Early warning
That a significant incident has occurred, whether unlawful or malicious action is suspected and whether it could have cross-border impact.
Incident notification
An initial assessment of the incident: severity, impact and, where available, indicators of compromise. This updates the early warning.
Intermediate report
If the authority requests a status update, you provide it. If the situation changes significantly, you should report again on your own initiative.
Final report
No later than one month after the 72-hour notification: a detailed description, the type of threat or root cause, the mitigation measures taken and any cross-border impact. If the incident is still ongoing, a progress report comes first.
GDPR and the CRA often come on top.
An incident can fall under several sets of rules at the same time. Each notification then has its own recipient and its own deadline.
| Regulation | When | To whom | Deadlines |
|---|---|---|---|
| NIS2 (in Germany: BSIG) | Significant incident | Competent authority / CSIRT (in Germany the BSI) | 24 h, 72 h, 1 month |
| GDPR Art. 33 | Personal data breach, unless it is unlikely to result in a risk to the data subjects | Data protection supervisory authority | 72 h |
| GDPR Art. 34 | Likely high risk to the data subjects | Data subjects | without undue delay |
| Cyber Resilience Act Art. 14 (guide) | Actively exploited vulnerability or severe incident affecting a product with digital elements that you manufacture | CSIRT or ENISA reporting platform | 24 h, 72 h, final report |
The reporting obligations of the Cyber Resilience Act have applied since 11 September 2026 and concern manufacturers of hardware and software. In addition, NIS2 entities may have to inform the recipients of their services about significant incidents.
How to be ready before things get serious.
24 hours is short, especially on a Friday evening. These six points should be settled in advance.
Assign responsibility
Who decides whether an incident is significant, and who reports it? With deputies, including outside office hours.
Define criteria in advance
Write down when an incident counts as significant for you. Then nobody has to work it out from scratch in an emergency.
Register with the authority
Affected entities must register with the competent authority (in Germany the BSI). Without access to the reporting portal, valuable time is lost.
Keep templates ready
A template with the mandatory details for every reporting stage. Filling in is faster than drafting.
Contacts at hand
Authority, data protection authority, service providers, insurer and management, maintained in one place.
Practise
Run through an incident once a year, including the notification. Gaps become apparent in the test, not in an emergency.
Keep track of deadlines with the reporting assistant.
In the incident module of WolfISMS you assess the reporting obligation under NIS2, GDPR and the CRA, see the running deadlines and receive a pre-filled notification text for each reporting stage. Every notification submitted is documented with time and reference number.