NIS2 incident reporting deadlines by EU country
The early warning of a significant incident must be submitted within twenty-four (24) hours. (S.L. 460.41, article 20)
The table shows, for each country we cover, the deadlines for reporting a significant incident under Article 23 of the NIS2 Directive — the early warning, the full notification and the final report — together with the competent authority. Where the EU directive baseline is shown, it is clearly labelled in the table.
| Early warning | Incident notification | Final report | Competent authority | Reporting channel | |
|---|---|---|---|---|---|
| Austria | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Zuständige Behörde und Meldepflicht (Cybersicherheitsbehörde, sektorspezifische CSIRTs — NISG § 4, § 34) [↗] | – |
| Belgium | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Bevoegde autoriteit en meldingsplicht (nationale cyberbeveiligingsautoriteit, nationale CSIRT — NIS2-wet art. 16, art. 35) [↗] | – |
| Bulgaria | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Компетентен орган и задължение за уведомяване (национален компетентен орган, СЕРИКС/CSIRT — ЗКС чл. 16, чл. 23) [↗] | СЕРИКС (national law) [↗] |
| Croatia | 24h (national law) [↗] | 72h (national law) [↗] | 30d (national law) [↗] | Nadležno tijelo i obveza obavještavanja (nadležni CSIRT / CARNET — Zakon o kibernetičkoj sigurnosti čl. 4, čl. 37) [↗] | nadležni CSIRT (Sigurnosno-obavještajna agencija või CARNET) (national law) [↗] |
| Cyprus | 6h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Αρμόδια αρχή και υποχρέωση κοινοποίησης (Αρχή Ψηφιακής Ασφάλειας — Ν. 60(Ι)/2025 άρθρο 30, 35Β) [↗] | Αρχή Ψηφιακής Ασφάλειας (national law) [↗] |
| Czechia | 24h (national law) [↗] | 72h (national law) [↗] | 30d (national law) [↗] | Příslušný úřad a ohlašovací povinnost (Úřad, Národní CERT — zákon 264/2025 Sb. § 42, § 43, § 16) [↗] | Úřad (vyšší kohustusetase) / Národní CERT (madalam tase) (national law) [↗] |
| Denmark | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kompetent myndighed og underretningspligt (kompetent myndighed, CSIRT — NIS2-loven § 12, § 13) [↗] | – |
| Estonia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Estonian supervisory and competent authority: Estonian Information System Authority (RIA) [↗] | Riigi Infosüsteemi Amet (national law) [↗] |
| Finland | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Keskitetty yhteyspiste Suomessa: Liikenne- ja viestintäviraston Kyberturvallisuuskeskus (18 §) [↗] | – |
| Germany | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Competent supervisory authority in Germany: Federal Office for Information Security (BSI) [↗] | gemeinsame Meldestelle des BSI und BBK (national law) [↗] |
| Greece | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Αρμόδια αρχή και υποχρέωση αναφοράς (Εθνική Αρχή Κυβερνοασφάλειας, CSIRT — Νόμος 5160/2024 άρθρο 8, 16) [↗] | CSIRT της Εθνικής Αρχής Κυβερνοασφάλειας (national law) [↗] |
| Hungary | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kiberbiztonsági hatóság és bejelentési kötelezettség (nemzeti kiberbiztonsági hatóság — 2024. évi LXIX. törvény § 23, § 8) [↗] | Nemzetbiztonsági Szakszolgálat (Központ) (national law) [↗] |
| Italy | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Autorità nazionale competente NIS e Punto di contatto unico in Italia: ACN (art 10) [↗] | CSIRT Italia (national law) [↗] |
| Latvia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kompetentā iestāde un ziņošanas pienākums (Nacionālais kiberdrošības centrs — NKDL 4. pants, 34. pants) [↗] | – |
| Lithuania | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Kompetentinga institucija ir registravimasis (Nacionalinis kibernetinio saugumo centras — KSĮ 7 str., 11 str.) [↗] | Nacionalinis kibernetinio saugumo centras (national law) [↗] |
| Luxembourg | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Autorité compétente et obligation d'enregistrement (Institut luxembourgeois de régulation — loi du 5 mai 2026, art. 3, art. 11, art. 14) [↗] | Institut luxembourgeois de régulation (ILR); pangandus- ja finantsturu-infrastruktuuris CSSF (national law) [↗] |
| Malta | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Supervisory authority and notification duty (CIP Department, national CSIRT — S.L. 460.41 article 7, article 20) [↗] | national CSIRT (Malta Information Technology Agency) (national law) [↗] |
| Netherlands | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Bevoegde autoriteit, CSIRT en meldpunt (Minister van Justitie en Veiligheid als CSIRT — Cbw art. 15, 26–27, 43–44; Cbb art. 2, 25, 27) [↗] | – |
| Poland | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Właściwy CSIRT sektorowy i obowiązek zgłaszania incydentów (CSIRT sektorowy — uKSC art. 11) [↗] | – |
| Portugal | 24h (national law) [↗] | 72h (national law) [↗] | 30wd (national law) [↗] | Autoridade competente e registo (CNCS — Decreto-Lei n.º 125/2025 artigo 19.º, artigo 8.º) [↗] | CNCS (Centro Nacional de Cibersegurança) / CERT.PT (national law) [↗] |
| Romania | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Autoritate competentă și obligația de raportare (DNSC, CSIRT național — OUG 155/2024 art. 24, art. 15) [↗] | PNRISC (national law) [↗] |
| Slovakia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Príslušný orgán a registračná povinnosť (Národný bezpečnostný úrad — zákon č. 69/2018 Z. z. § 4, § 17) [↗] | jednotný informačný systém kybernetickej bezpečnosti (national law) [↗] |
| Slovenia | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Pristojni organ in obveznost priglasitve (Urad Vlade RS za informacijsko varnost, CSIRT — ZInfV-1 10. člen, 30. člen) [↗] | – |
| Sweden | 24h (national law) [↗] | 72h (national law) [↗] | 1mo (national law) [↗] | Gemensam kontaktpunkt (SPOC) i Sverige: Försvarets radioanstalt (1 kap. 17 §; förordning 2025:1507 § 23) [↗] | – |
Deadlines under national law: Malta
The quotations below are taken word for word from the country's own legal act that sets these deadlines. Each quotation carries a reference to the official source.
Early warning
within twenty-four (24) hours of becoming aware of the significant incident, an early warning, which where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross- border impact; (b) without undue delay and in any event withinReference: S.L. 460.41, article 20 — View official source
Incident notification
within seventy-two (72) hours of becoming aware of the significant incident, an incident notification, which where applicable, shall update the information referred to in paragraph (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as where available, theReference: S.L. 460.41, article 20 — View official source
Final report
a final report not later than one (1) month after the submission of the incident notification in accordance with sub- article (5)(b), including the following: (i) a detailed description of the incident, including its severity and impact; (ii) the type of threat or root cause that is likely to have triggered theReference: S.L. 460.41, article 20 — View official source
Frequently asked questions
What are the NIS2 incident reporting deadlines in Malta?
NIS2 incident reporting deadlines in Malta: Early warning 24h; Incident notification 72h; Final report 1mo. Basis: S.L. 460.41 article 20; the table links to the official source.