What are the NIS2 incident reporting deadlines?

Under Article 23 of Directive (EU) 2022/2555, essential and important entities must submit an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours (updating the early warning), and a final report within one month.

Who do I submit the notification to?

To the CSIRT or competent authority designated by your Member State — in Denmark, Center for Cybersikkerhed (CFCS). Most Member States run a dedicated reporting portal. The generator produces the document; you submit it through your national portal.

Is this legal advice?

No. The generator structures your information according to the Annex I requirements of Directive (EU) 2022/2555, but national implementing laws may require additional fields. Confirm with your national CSIRT's guidance.

Does anything I enter leave my browser?

No. The generator runs entirely client-side. Nothing is sent to any server, nothing is stored, there are no cookies. You copy or download the finished report yourself.

FREE TOOL

NIS2 Incident Report Generator

Article 23 requires an early warning within 24 hours, a notification within 72 hours and a final report within one month of a significant incident. Fill in what you know — get a structured draft.

1. The reporting entity Company / organisation name Entity type under NIS2 Contact person Contact e-mail Contact phone

2. Timeline When did you become aware of the incident?

Deadlines are calculated when you fill in this field: early warning due within 24 hours, notification within 72 hours, final report within 1 month — all counted from the moment of awareness.

Which stage are you filing now? Is the incident ongoing? If resolved: when was it resolved?

3. The incident Short summary of what happened Cause (as far as known) Severity assessment Affected services and impact Personal data or other data compromised? Measures taken / planned Does the incident affect other Member States or third countries? If yes, which countries/services are affected? Do you have reason to believe the incident may cause malicious exploitation?

4. Receiving authority CSIRT / competent authority receiving this report

Submit through your national reporting portal. In Denmark: cfcs.dk. The generator only produces the document — submission happens on the official portal.

The three Article 23 deadlines

Early warning — 24 hours. A short notice stating whether the incident is suspected to be caused by unlawful or malicious acts, whether it could have cross-border impact, and whether it may cause malicious exploitation. You do not need all the facts yet.
Incident notification — 72 hours. An update with an initial assessment of severity and impact, including indicators of compromise where available.
Final report — 1 month. A detailed description including the likely cause, mitigation measures already applied and planned, and cross-border effects. If the incident is still ongoing, a status report is submitted first.

Honest limitation: Member State implementations vary in portal, format and extra fields. This generator follows the Annex I requirements of the directive text; always check your national CSIRT's own guidance before submitting.