The three Article 23 deadlines
- Early warning — 24 hours. A short notice stating whether the incident is suspected to be caused by unlawful or malicious acts, whether it could have cross-border impact, and whether it may cause malicious exploitation. You do not need all the facts yet.
- Incident notification — 72 hours. An update with an initial assessment of severity and impact, including indicators of compromise where available.
- Final report — 1 month. A detailed description including the likely cause, mitigation measures already applied and planned, and cross-border effects. If the incident is still ongoing, a status report is submitted first.
Honest limitation: Member State implementations vary in portal, format and extra fields. This generator follows the Annex I requirements of the directive text; always check your national CSIRT's own guidance before submitting.
Related: free NIS2 gap assessment · self-assessment · NIS2 readiness guide · incident report checklist