CLAIM-2026-09-12-03

Article 14 requires an early warning within 24 hours of awareness, a notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available; for severe incidents the final report is due within one month of the incident notification. Both go simultaneously to the CSIRT designated as coordinator and to ENISA via the single reporting platform.

Why it matters

The recipient is not the data protection authority and the artefact is not a breach notification. An incident runbook written only against GDPR sends the right facts to the wrong body.

Sources

• enisa2026faq
• europeancyb2024reporting