the work

incident reporting

One event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.

NIS2 / DORA / GDPR / AI Actlast checked 2 November 2026not legal advice
01

the reality

Reports are allowed to be incomplete. A NIS2 early warning only has to say whether the incident looks malicious and whether it might cross borders, a GDPR notification can come in phases, and notifying does not by itself increase your liability under NIS2. So the safe default is to file early and correct later.

one event, three clocks

4 hours24 hours72 hours1 month
NIS2
early warning, from becoming aware of a significant incident
incident notification with a first assessment
final report, one month after the notification
DORA
initial notification, 4 hours after classifying as major
that same notification, 24 hours after awareness at the latest
intermediate report, 72 hours after the initial one
final report, one month after the last intermediate
GDPR
tell the authority, where feasible, unless a risk to people is unlikely
The clocks start at different moments and go to different authorities. GDPR also asks you to tell the people affected without undue delay when the risk to them is high. Poland counts the NIS2 hours from detecting the incident.

basis NIS2 Art. 23(4); RTS 2025/301 Art. 5(1); GDPR Art. 33(1), 34(1); KSC Art. 11

basis NIS2 Art. 23(1), 23(4); GDPR Art. 33(4); RTS 2025/301 Art. 5(1)

02

what to decide

  • Who can declare an incident, at any hour, without asking anyoneboard, on a proposal from IT
  • Who files with which authority, and their deputiesnamed owner
  • What counts as significant for you, in numbers that fit your companyboard
  • Who may speak to customers and staffchief executive

basis NIS2 Art. 21(2)(b), 23(1), 23(3); GDPR Art. 34(1). The owners are practice.

who does what in the first day

boardincident leadITlawyer or DPOcomms
say this counts as an incidentis tolddecidesdoesadvises
contain and recoverownsdoes
decide what is reportableis tolddecidesdoesadvises
file the notificationsis toldownsdoeschecks
tell customers and staffdecidesadvisesadvisesdoes
Name a deputy for each column. Test this table against a Saturday night.

basis working practice. No legal text sets this.

03

what to build

  1. One page: who decides, who calls the lawyer, who files each report, with a deputy for each.
  2. A contact sheet for each authority, with the portal or address. Log in once this week, while nothing is on fire.
  3. Your written significance test. A national or sector threshold overrides it where one exists.
  4. A breach log, started today, even if it is empty. Record events you decide are not reportable, with the reason.
  5. A 60-minute tabletop using that page. Pick a stolen laptop and a supplier breach, and write down what you could not answer.

basis NIS2 Art. 21(2)(b); GDPR Art. 33(5); IR 2024/2690 Annex 3.1 as a reference

which clocks did this event just start?

  1. Has it caused, or could it cause, severe disruption or financial loss, or considerable damage to others?
    either way
    yesSignificant under NIS2: 24 hours, 72 hours, one month.
  2. Are you a financial entity, and is it a major ICT incident?
    either way
    yesDORA: 4 hours from classifying, 24 hours from awareness at the latest.
  3. Is personal data involved, with a risk to people that is not unlikely?
    either way
    yesGDPR: the authority within 72 hours where feasible.
  4. Is the risk to those people high?
    either way
    yesGDPR: tell them without undue delay.
  5. Log it, even if every answer was no.

basis NIS2 Art. 23(3), 23(4); RTS 2025/301 Art. 5(1); GDPR Art. 33(1), 33(5), 34(1). Logging non-breach events is practice.

04

the evidence it leaves

what you can showwho owns itrefresh
incident procedure with named roleshead of ITyearly and after any incident
contact sheet for each authorityhead of ITtwice a year
written significance criteriaboardyearly
incident and breach loghead of IT and DPOeach event
filed notifications with timestampshead of IT and lawyereach report
tabletop record: date, scenario, attendees, gapshead of ITyearly

basis GDPR Art. 33(5); IR 2024/2690 Annex 3.1. The refresh rates are practice.

05

what goes wrong

waiting for the full picture

Early reports may be incomplete. A company was fined €475,000 for reporting 22 days late. The case.

nobody may decide

The person who sees the problem has no authority to call it, and the person who has authority is on a plane.

the supplier's incident

Your clock can start from their notice, which only arrives if your contract asks for it. Supplier risk.

fixing it and closing the file

A notification can be fined for what it left out, and a breach record for what it failed to document. The case.

basis GDPR Art. 33(1), 33(3), 33(5), via the cases linked; the rest is practice

06

what the texts leave open

  • When exactly you became aware. The EDPB treats it as a reasonable degree of certainty that a breach happened. NIS2 uses the same word without defining it.
  • Poland counts from detecting the incident. Other national acts may differ, so read yours.
  • NIS2 sets no numeric test for most sectors. Your authority may publish one. Listed digital providers have numbers already, such as direct loss above €500,000 or 5% of turnover.
  • Whether one notification can serve two rules. Assume it cannot until your authority says so. A single entry point has been proposed and is not law.

basis NIS2 Art. 23(4); KSC Art. 11; EDPB Guidelines 9/2022

07

check it yourself

what each text says, for whoever checks this page
textsays
NIS2 Art. 23(4)Early warning within 24 hours of becoming aware of a significant incident. Notification within 72 hours. Final report within one month of the notification.
NIS2 Art. 23(3)Significant means severe operational disruption or financial loss, or considerable damage to others, caused or possible.
IR 2024/2690 Art. 3(1)Listed digital providers: numeric tests, such as direct loss above €500,000 or 5% of turnover, whichever is lower.
DORA Art. 19(1)Report major ICT incidents to your competent authority, in three stages.
RTS 2025/301 Art. 5(1)Initial notification within 4 hours of classifying as major, no later than 24 hours after awareness. Intermediate report within 72 hours. Final report within one month.
GDPR Art. 33(1)Tell the authority within 72 hours of becoming aware, unless unlikely to result in a risk. Give reasons if later.
GDPR Art. 33(4)Information may be provided in phases.
GDPR Art. 34(1)Tell the people affected without undue delay when the risk to them is high.
GDPR Art. 33(5)Document every personal data breach so the authority can verify compliance.
AI Act Art. 26(5)Deployers of high-risk AI report serious incidents to the provider and the authority, from 2 December 2027.
KSC Art. 11Poland: early warning within 24 hours and notification within 72 hours of detecting a serious incident, final report within a month.

fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.

your next step

Open a blank page and write the three clocks that apply to you, with the name of the person who files each one.

see what else this answers