For entities subject to NIS2, significant incidents are reported to the national CSIRT or competent authority. The reporting follows a tiered timeline: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours providing an updated severity and impact assessment, and a final report within one month.

NIS2-specific fields include the number of users affected, the cross-border impact, and the CSIRT-specific format required by the relevant member state’s transposition. These fields are prepared as a regime-specific annex to the shared incident fact sheet.

NIS2’s 24-hour early warning is typically the second-earliest deadline after DORA’s four hours (if applicable). For entities subject to both NIS2 and the AI Act but not DORA, the NIS2 early warning drives the preparation cadence. If the entity is not subject to NIS2, this article is documented as not applicable.

Key outputs

• NIS2 reporting stream (24h/72h/1mo) to national CSIRT
• NIS2-specific fields (users affected, cross-border impact, CSIRT format)
• Content consistency with parallel reporting streams
• Module 9 AISDP documentation