When an incident report deadline is running: what it costs to be wrong

An incident report deadline that has already started does not pause while you investigate. Under Directive (EU) 2022/2555 (NIS2), the notification duty attaches to the moment your organisation becomes aware of a significant incident, not to the moment you finish analysing it. Filing late, or filing on facts you later correct, turns a technical event into a compliance failure the authority assesses on its own terms.

What sets the deadline running

Directive (EU) 2022/2555 (NIS2) sets the notification duty for essential and important entities within its scope. The directive builds a staged timeline: an early notification, a follow-up assessment, and a final report, each triggered by a fixed count of hours from confirmed awareness. The precise hour count, and the addressee — a CSIRT or a competent authority — sit in the national law that transposes the directive in your jurisdiction, and that national text is outside this record.

Where the same event also affects personal data, a parallel notification duty runs under the applicable data protection framework, on its own clock and to its own authority. The two duties do not merge into one filing, even when the same team drafts both.

What changes once the clock starts

Two things move immediately. First, the authority's assessment now includes the gap between awareness and notification — a gap you cannot shorten after the fact. Second, if the incident touches a vendor relationship, the vendor's own obligations often depend on your notice. If the vendor cannot remediate in time, an escrow clause tied to a security failure can be triggered — When source code escrow is demanded in detail lays out how that demand is handled once it lands.

What to do, in order

1. Security lead: freeze the timeline. Record the exact moment awareness was confirmed and who confirmed it.
2. Legal or DPO: list every deadline running in parallel — cybersecurity notification, data protection notification, contractual notice to affected clients.
3. Compliance officer: file the first, mandatory notification even on incomplete facts, marked as preliminary.
4. IT and security: preserve the evidence trail — logs, tickets, internal messages — before the follow-up report falls due.
5. Legal: check every contract triggered by the same event, including any data-sharing term that depends on a licence: When a licence must be recorded to be effective explains when that record protects you.
6. Legal, before publication: brief anyone drafting the external status update. When marketing is treated as an offer and its consequences explains why a reassuring sentence can bind you.

Who decides, and on what evidence

The competent authority or CSIRT designated under your national NIS2 implementing act decides whether your notification was timely and adequate. It decides on the timestamped filing you submitted, not on an account given afterwards. A data protection authority decides separately if personal data is involved, on its own record. The two authorities do not automatically share a file; a gap in one filing does not excuse a gap in the other.

If your situation looks like this

If a competitor learns of the technical gap the incident exposed and moves to file first, that is a separate race your incident-response file does not defend against — A competitor files a patent application next to your product walks through that track on its own terms.

If your entity operates through both a Lithuanian and an Estonian establishment, each may face a separate CSIRT or competent authority for the same incident. Filing in one country does not discharge the duty in the other.

If this is not the first significant incident from the same root cause, the authority's assessment of your remediation record becomes part of the file, alongside the notification itself.

What this page does not cover

This page does not calculate the exact hour count that applies to your notification, draft the filing itself, or decide whether your incident meets the "significant" threshold under the directive. That determination depends on the facts of your systems and on the wording of the national implementing act, which this record does not hold. It also does not cover the AI Act's serious-incident duty before Regulation (EU) 2024/1689 (AI Act) takes effect on 2 August 2026 — until that date, only the cybersecurity and data protection clocks run.

Sizing the file properly — how many authorities, how many jurisdictions, whether a regulator has already made contact — is a separate step handled once the facts above are confirmed.

Verified

Checked against the current text of the following instruments: Directive (EU) 2022/2555 (NIS2), in force from 18 October 2024; Regulation (EU) 2024/1689 (AI Act), in force from 2 August 2026. National implementing acts and data protection provisions are not part of this record and are confirmed separately for your jurisdiction before any filing is made.

Related publications

The closest parallel arises when the same event touches a machine-learning pipeline: When an AI feature changes the data flow: what it costs to be wrong sets out that separate assessment.

FAQ

What is the first step when an incident report deadline is running?

Confirm the exact moment your organisation became aware of the incident, and record who confirmed it. Every later deadline calculation runs from that timestamp, not from when the investigation finishes.

Which deadline is already running?

At minimum, the notification duty under Directive (EU) 2022/2555 (NIS2), if your entity falls within its scope. If personal data is also affected, a parallel duty runs under the applicable data protection framework, on its own clock, to its own authority.

Who decides, and on what evidence?

The competent authority or CSIRT designated under your national NIS2 implementing act decides, based on the timestamped filing you submitted. A data protection authority decides separately, on its own record, if personal data is involved.

— Rasa Tumenaite, AURELIS