NIS2 incident reporting deadlines by EU country
The table shows, for each country we cover, the deadlines for reporting a significant incident under Article 23 of the NIS2 Directive — the early warning, the full notification and the final report — together with the competent authority. Where a provision of that country's own law has not yet been identified in our knowledge base, the EU directive baseline is shown with a clear label.
| Early warning | Incident notification | Final report | Competent authority | Reporting channel | |
|---|---|---|---|---|---|
| Austria | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Zuständige Behörde und Meldepflicht (Cybersicherheitsbehörde, sektorspezifische CSIRTs — NISG § 4, § 34) [↗] | – |
| Belgium | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Bevoegde autoriteit en meldingsplicht (nationale cyberbeveiligingsautoriteit, nationale CSIRT — NIS2-wet art. 16, art. 35) [↗] | – |
| Bulgaria | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Компетентен орган и задължение за уведомяване (национален компетентен орган, СЕРИКС/CSIRT — ЗКС чл. 16, чл. 23) [↗] | – |
| Croatia | 24h (EU directive baseline) [↗] | 72h (EU directive baseline) [↗] | 30d (EU directive baseline) [↗] | Nadležno tijelo i obveza obavještavanja (nadležni CSIRT / CARNET — Zakon o kibernetičkoj sigurnosti čl. 4, čl. 37) [↗] | – |
| Cyprus | 6h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Αρμόδια αρχή και υποχρέωση κοινοποίησης (Αρχή Ψηφιακής Ασφάλειας — Ν. 60(Ι)/2025 άρθρο 30, 35Β) [↗] | – |
| Czechia | 24h (national law) [↗] | 72h (national law) [↗] | 30d (national law) [↗] | Příslušný úřad a ohlašovací povinnost (Úřad/NÚKIB, Národní CERT — zákon 264/2025 Sb. § 42, § 43, § 16) [↗] | – |
| Denmark | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kompetent myndighed og underretningspligt (kompetent myndighed, CSIRT — NIS2-loven § 12, § 13) [↗] | – |
| Estonia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Estonian supervisory and competent authority: Estonian Information System Authority (RIA) [↗] | – |
| Finland | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Keskitetty yhteyspiste Suomessa: Liikenne- ja viestintäviraston Kyberturvallisuuskeskus (18 §) [↗] | – |
| Germany | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Competent supervisory authority in Germany: Federal Office for Information Security (BSI) [↗] | – |
| Greece | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Αρμόδια αρχή και υποχρέωση αναφοράς (Εθνική Αρχή Κυβερνοασφάλειας, CSIRT — Νόμος 5160/2024 άρθρο 8, 16) [↗] | – |
| Hungary | 24h (EU directive baseline) [↗] | 72h (EU directive baseline) [↗] | 30d (EU directive baseline) [↗] | Kiberbiztonsági hatóság és bejelentési kötelezettség (nemzeti kiberbiztonsági hatóság — 2024. évi LXIX. törvény § 23, § 8) [↗] | – |
| Italy | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Autorità nazionale competente NIS e Punto di contatto unico in Italia: ACN (art 10) [↗] | – |
| Latvia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kompetentā iestāde un ziņošanas pienākums (Nacionālais kiberdrošības centrs — NKDL 4. pants, 34. pants) [↗] | – |
| Lithuania | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kompetentinga institucija ir registravimasis (Nacionalinis kibernetinio saugumo centras — KSĮ 7 str., 11 str.) [↗] | – |
| Luxembourg | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Autorité compétente et obligation d'enregistrement (Institut luxembourgeois de régulation — loi du 5 mai 2026, art. 3, art. 11, art. 14) [↗] | – |
| Malta | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Supervisory authority and notification duty (CIP Department, national CSIRT — S.L. 460.41 article 7, article 20) [↗] | – |
| Poland | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Właściwy CSIRT sektorowy i obowiązek zgłaszania incydentów (CSIRT sektorowy — uKSC art. 11) [↗] | – |
| Portugal | 24h (national law) [↗] | 72h (national law) [↗] | 30wd (national law) [↗] | Autoridade competente e registo (CNCS — Decreto-Lei n.º 125/2025 artigo 19.º, artigo 8.º) [↗] | – |
| Romania | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Autoritate competentă și obligația de raportare (DNSC, CSIRT național — OUG 155/2024 art. 24, art. 15) [↗] | PNRISC (national law) [↗] |
| Slovakia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Príslušný orgán a registračná povinnosť (Národný bezpečnostný úrad — zákon č. 69/2018 Z. z. § 4, § 17) [↗] | jednotný informačný systém kybernetickej bezpečnosti (national law) [↗] |
| Slovenia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Pristojni organ in obveznost priglasitve (Urad Vlade RS za informacijsko varnost, CSIRT — ZInfV-1 10. člen, 30. člen) [↗] | – |
| Sweden | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Gemensam kontaktpunkt (SPOC) i Sverige: MCF t.o.m. 2026-06-30, därefter FRA (1 kap. 17 §; förordning 2025:1507 § 23) [↗] | – |