Incident reporting

A strict, multi-stage reporting clock

When a significant incident occurs, the countdown starts. Entities must notify their CSIRT or competent authority in escalating stages — missing a deadline is itself a compliance failure.

24h

Early warning

Submit an initial early warning to your CSIRT or competent authority, indicating whether the incident is suspected to be caused by unlawful or malicious acts, or could have cross-border impact.

72h

Incident notification

Update the early warning with an initial assessment — the severity and impact, and any indicators of compromise identified so far.

1 month

Final report

Within one month of the incident notification, submit a detailed report: the root cause, the mitigation applied and ongoing, and the full nature and impact of the incident.

Intermediate progress reports may be requested at any time, and the one-month clock for the final report runs from the 72-hour incident notification — not from the incident itself.

What counts as a significant incident

An incident is significant if it has caused, or is capable of causing:

  • severe operational disruption or financial loss to the entity; or
  • considerable material or non-material damage to other natural or legal persons.

Commission Implementing Regulation (EU) 2024/2690 sets quantitative thresholds for specific digital sectors, and national guidance may add further criteria.

The reporting stages

  1. Early warning (24 hours): flag whether the incident is suspected to be caused by unlawful or malicious acts, or could have cross-border impact.
  2. Incident notification (72 hours): update the early warning with an initial assessment of severity and impact, and any indicators of compromise.
  3. Progress reports: provided at the CSIRT's request while the incident is being handled.
  4. Final report (one month): a detailed description, the root cause, the mitigation applied and ongoing, and any cross-border impact — within one month of the incident notification.

Who you report to

Your national CSIRT, or the competent authority named in your transposition law. The CSIRT provides a response and, where relevant, coordinates across borders. Where appropriate, you must also inform the recipients of your services about a significant incident and the measures or remedies they can take.

Build the workflow before you need it

A 24h / 72h / one-month process with clear owners is step five of the roadmap.

See the roadmap →