CLAIM-2026-08-02-06

Article 23(4) of Directive (EU) 2022/2555 (NIS2) requires an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours of becoming aware, an intermediate report on request, and a final report not later than one month after the incident notification.

Why it matters

For an in-scope essential or important entity the binding number is 24 hours, not 72, and it also runs from awareness. That is a shorter fuse than most incident-response runbooks assume, and it lands on whoever reads the vendor email first.

Sources

• nisdirectiv2022nis