We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideEU

EU NIS2 Directive 24-hour early warning

NIS2 Article 23 requires an early warning without undue delay and within 24 hours after a covered entity becomes aware of a significant incident.

Decide what to send, which timestamps and facts to preserve, and which national competent-authority or CSIRT route to use.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
4

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

A covered essential or important entity must submit an without undue delay and, in any event, within 24 hours after it becomes aware of a . Detection alone does not necessarily start the clock, but the entity cannot wait for a final root cause: it should assess suspicious events promptly and record when the Article 23 significance threshold was met, and it must use the applicable national or competent-authority route.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

What does the NIS2 24-hour early warning require?

Under NIS2 Article 23, essential and important entities notify their or competent authority of significant incidents. The first required step is an submitted without undue delay and, in any event, within 24 hours of becoming aware of the .

The is not the full incident report. It must indicate, where applicable, whether unlawful or malicious acts are suspected or whether the incident could have a cross-border impact. The 72-hour incident notification supplies the initial severity and impact assessment and available indicators of compromise.

  • Start with the Article 23 significance test: severe operational disruption, financial loss, or considerable material or non-material damage to others.
  • For entities covered by Implementing Regulation (EU) 2024/2690, also test its horizontal and provider-specific criteria. Examples include direct financial loss exceeding the lower of EUR 500,000 or 5 percent of prior-year turnover, malicious unauthorised access capable of severe disruption, and sector thresholds for outage duration, affected users, or compromised data.
  • Record detection, escalation, initial assessment, awareness, approval, and submission times separately. A supplier alert or security event may start triage without yet establishing awareness of a .
  • Send the through the national route designated for the entity, usually the or competent authority.
  • Keep the 72-hour incident notification, requested intermediate reports, and final report linked to the same incident record.

How should teams handle 24-hour under the EU NIS2 Directive?

Submit the without undue delay and within 24 hours after the entity becomes aware of a . Record why Article 23(3) is met, the awareness time, suspected unlawful or malicious activity and possible cross-border impact where applicable, and the national or competent-authority route. Do not delay the warning for a complete root-cause analysis.

Citations
Question 2

What evidence should teams keep for the NIS2 24-hour early warning?

The evidence file should prove the significance decision and the timing. Keep the detection record, initial assessment, awareness timestamp, affected services, notification route, warning payload, submission receipt, and escalation approvals together. Preserve facts that were uncertain at submission instead of silently replacing the first assessment later.

Do not wait for the final root cause before sending the . Article 23 expects a staged process: early warning, 72-hour incident notification, intermediate reports if requested, and a final report after the incident notification or after handling a continuing incident.

  • Article 23 citation, national authority route, and the exact notification channel used.
  • Awareness timestamp, significance assessment, incident commander, legal reviewer, authority-contact owner, and approval time.
  • Affected network and information systems, service, country, supplier, customer group, and known or possible cross-border impact.
  • Submitted early-warning text, submission receipt, acknowledgement, and any or competent-authority request.
  • Links to the 72-hour notification, requested intermediate updates, final report, mitigation actions, and lessons learned.
Citations
Question 3

Which edge cases can affect the NIS2 24-hour early-warning clock?

Awareness, significance, and routing often require separate decisions. Determine when the entity had enough information to conclude that Article 23(3), applicable national criteria, or binding sector-specific criteria were met; then identify the correct national route and possible cross-border impact.

For the DNS, TLD, trust-service, cloud, data-centre, CDN, MSP, MSSP, marketplace, search, and social-platform entities covered by Implementing Regulation (EU) 2024/2690, its recitals treat the entity as aware when its initial assessment provides a reasonable degree of certainty that a occurred. The regulation also supplies binding horizontal and entity-specific significance criteria. Scheduled interruptions and planned maintenance consequences are excluded under that regulation, while incidents with the same apparent root cause can count collectively when they occur at least twice within six months and together cross its financial-loss criterion. Other entities must use Article 23, national implementing law, and applicable authority guidance.

  • A group incident may require separate routing if different legal entities, sectors, or Member States are affected.
  • A supplier or managed-service-provider alert may start triage, but the covered entity still needs its own significance and awareness assessment; outsourcing does not transfer the reporting duty.
  • A possible criminal incident should be flagged because Article 23 expects guidance on law-enforcement reporting where the incident appears criminal.
  • Track authority feedback: the or competent authority must respond without undue delay and, where possible, within 24 hours after receiving the , with initial feedback and requested guidance or operational advice.
  • National law or authority guidance can specify the portal, form, language, acknowledgement process, sector authority, and information fields. Keep those procedural rules in the country playbook.
Citations
Recommended next step

Assign the warning, evidence, and follow-up steps

Sorena can turn the 24-hour early-warning decisions on this page into cited answers, owner assignments, evidence requests, and reusable review steps for EU NIS2 Directive work.

Research workflow
Open Research Copilot for EU NIS2 Directive

Ask questions tied to cited sources about the 24-hour early warning, scope, deadlines, and evidence using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through NIS2 24-hour early warning implementation

Review your 24-hour early-warning workflow, source gaps, and next implementation steps with Sorena.

Explore next step
Primary sources

References and citations

Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Article 23 covers cross-border notifications, CSIRT or authority feedback, and criminal-reporting guidance.
"could have a cross-border impact"
Related guides

Explore more topics

Are managed service providers in scope of NIS2?
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
EU NIS2 Directive applicability test for entity scope
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
NIS2 72-hour incident notification FAQ
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
NIS2 Annex I and Annex II Sector Scoping Guide
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
NIS2 Article 21 control baseline and evidence checklist
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
NIS2 Article 21 control-by-control evidence checklist
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
NIS2 Article 23 incident notification workflow
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
NIS2 Compliance Checklist: scope, controls, reporting
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
NIS2 Compliance Guide: scope, controls, reporting, and evidence
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
NIS2 entity classification FAQ
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
NIS2 Entity Classifier Workflow: essential vs important entity scoping
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
NIS2 entity supervision guide
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
NIS2 essential vs important entities: Article 3 scope and supervision guide
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
NIS2 incident clock triage workflow
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
NIS2 Management Body Accountability: board duties, training, and evidence
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
NIS2 Member State Transposition: What Teams Must Check
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
NIS2 National Transposition Tracker: EU Member State Evidence Register
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 penalties and fines: Article 34 maximum levels and factors
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
NIS2 Registration and Authority Notification Guide
Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines.
NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
NIS2 Size Cap Rule and Special Scope Cases
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
NIS2 size-cap rule: when medium and large entities are in scope
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.
NIS2 Supply Chain Security Program: Article 21 Guide
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
NIS2 vs GDPR breach reporting: EU deadlines and overlap
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
NIS2 vs NIS1: what changed in EU cybersecurity compliance
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.