CLAIM-2026-10-03-09

Article 23(4)(d) of Directive (EU) 2022/2555 (NIS2) requires a final report not later than one month after the submission of the incident notification, including a detailed description of the incident, the type of threat or root cause that is likely to have triggered it, applied and ongoing mitigation measures, and where applicable its cross-border impact.

Why it matters

This is the live duty with teeth, and it is not about the clock: it asks you to state what you fixed. An agent-authored repair that did not survive a restart makes that statement false under your signature.

Sources

• nisdirectiv2022nis
• eurlex2022directive