What are the incident reporting deadlines under NIS2 and DORA?
NIS2 and DORA both require staged incident reports on fixed clocks that start the moment you detect a qualifying incident. NIS2 sets an early warning within 24 hours of awareness, a notification within 72 hours, and a final report within one month. DORA sets an initial notification within 4 hours of classifying an incident as major, an intermediate report within 72 hours, and a final report within one month.
NIS2 governs essential and important entities across eighteen sectors. DORA governs financial entities and the ICT providers they depend on. An organisation can fall under one, the other, or both. The deadlines are similar in shape but not identical, and the differences matter once a live incident is running.
NIS2 in three stages
- Early warning: within 24 hours of becoming aware of a significant incident.
- Incident notification: within 72 hours of becoming aware, with an initial assessment of severity and impact.
- Final report: within one month of the notification, covering root cause and remediation.
DORA in three reports
- Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.
- Intermediate report: within 72 hours of the initial notification.
- Final report: within one month of the latest intermediate report.
When does the reporting clock actually start?
Both regimes tie the clock to the moment of awareness, not to the moment a report is ready and not to the start of the next working day. Under NIS2, the 24-hour and 72-hour deadlines run from when the entity becomes aware of the significant incident. Under DORA, the 72-hour and one-month deadlines run from the initial notification, and the initial notification itself is due within 4 hours of the point at which the incident is classified as major.
DORA adds a second clock that is easy to misread. The 4-hour deadline begins at classification; the 24-hour limit from awareness is the outer cap. Classify quickly and only four hours remain; classify slowly and the 24-hour cap bites regardless. Fast, defensible classification is therefore the real constraint, which is why the criteria in the classification standard, Commission Delegated Regulation (EU) 2024/1772, need to be agreed and documented before an incident, not during one.
The practical consequence is the same under both frameworks: an incident detected at 23:00 on a Friday starts a clock that expires over the weekend. Neither regime pauses for nights, weekends or public holidays. DORA allows a narrow extension to noon on the next working day where a deadline falls on a weekend or holiday, but that extension is not available to credit institutions, central counterparties, trading venues, or any entity classified as essential or important under NIS2.
NIS2 Article 23: early warning, notification, final report
NIS2, Directive (EU) 2022/2555, applies to essential and important entities: organisations in one of eighteen listed sectors that generally have 50 or more staff or annual turnover above 10 million euros. If an organisation meets both the sector and the size test, it is in scope. For many companies that never considered themselves critical infrastructure, NIS2 is their first binding cybersecurity obligation.
A significant incident is one that causes or could cause severe operational disruption or financial loss, or considerable material or non-material damage to other people. The threshold is specified further in Commission Implementing Regulation (EU) 2024/2690. When one occurs, the three-stage cascade begins. The early warning is short: it flags the incident and, where relevant, whether it is suspected to be malicious or to have cross-border impact. The 72-hour notification adds an initial assessment of severity, impact and any indicators of compromise. The final report, due within one month, sets out root cause, the measures applied and any cross-border effects. If the incident is still live at the one-month mark, a progress report is submitted instead and the final report follows within one month of the incident being handled.
Reports go to the national CSIRT or the competent authority designated by each Member State, so the exact destination depends on where services are provided. NIS2 also carries a separate duty under Article 23 to inform the recipients of your services without undue delay where an incident is likely to affect them; that duty is distinct from reporting to the authority and is not satisfied by a status page alone. Failure to report is enforceable: fines reach 10 million euros or 2% of global annual turnover for essential entities, and 7 million euros or 1.4% for important entities.
Transposition varies by country, because a directive takes effect through national law. In Spain, the transposing bill, the Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, was approved by the Council of Ministers in January 2025 and remained in parliamentary passage through 2026, after Spain missed the October 2024 transposition deadline and received a reasoned opinion from the European Commission in May 2025. The directive's deadlines are what the national law will carry across, so the 24-hour, 72-hour and one-month structure is the right thing to build against now, whatever date the text finally reaches the official gazette. That is one reason an organisation weighing NIS2 readiness should not wait for the statute to start operating the capability.
DORA Article 19: initial notification, intermediate and final report
DORA, Regulation (EU) 2022/2554, applies to financial entities: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and more, together with the critical ICT third-party providers they rely on. Unlike a directive, a regulation applies directly across the Union without national transposition, so the DORA clocks have been running since the regulation entered application on 17 January 2025.
A major ICT-related incident sets off three reports, with the deadlines fixed in the regulatory technical standard on incident reporting, Commission Delegated Regulation (EU) 2025/301, Article 5. The initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours from awareness. The intermediate report follows within 72 hours of the initial notification, and is required even if the status has not changed; an updated intermediate report is due without undue delay once regular activities are restored. The final report is due no later than one month after the latest intermediate report, and covers root cause, impact and remediation. Reports go to the entity's competent supervisor, which in Spain means the authority matching the entity type, such as the Banco de Espana, the CNMV or the Direccion General de Seguros y Fondos de Pensiones. The wider obligations that sit around incident reporting, from ICT risk management to third-party oversight, are covered in our guide to the five pillars of DORA.
What each report has to contain
The reports escalate in detail as the incident unfolds, which is deliberate: the regime does not expect a full analysis in the first hours, but it does expect prompt notice. The first submission under either framework is short, a flag rather than a dossier: enough to tell the authority that something significant is happening and, where known, whether it looks malicious or cross-border. The 72-hour stage adds an initial severity and impact assessment and any indicators of compromise. The final report is the substantive one: root cause, the remediation applied, and the wider impact.
The trap is assuming these can be written on the day. They cannot, because the first two deadlines land while the incident is still being contained and the people who would write the report are the people running the response. The templates, the classification criteria and the named contacts have to exist beforehand. An organisation that has to design its notification form at hour three of a live incident has already lost most of the first window.
Why the first window is the hard part
The reports themselves are rarely the binding constraint. Detecting and classifying the incident fast enough to have anything to report is. Every deadline in both frameworks counts from awareness or classification, so the clock can be well advanced before anyone inside the organisation knows an incident is under way. An intrusion that begins at 02:00 on a Sunday consumes the NIS2 24-hour early-warning window and eats into DORA's 24-hour awareness cap while the office is empty.
This is where continuous detection stops being a nice-to-have. Meeting a 24-hour or a 4-hour clock assumes someone is watching when the alert fires, can triage it, and can make the classification call out of hours. A monitored security operation exists precisely to compress the time between an event happening and a human deciding what it is. Without one, the reporting obligation depends on an employee happening to notice, which is not a control an auditor or a supervisor will accept.
How to be ready before an incident
Meeting these deadlines is an operational capability, not a document. Four things need to be in place before an incident, not during one. First, written classification criteria and a designated person, with a deputy, who can decide whether an incident is significant or major without waiting for a committee. Second, pre-drafted templates for each stage, so the early warning is a form to complete rather than a document to invent. Third, a named point of contact and an established relationship with the relevant CSIRT or supervisor, so the first real contact is not made during the crisis. Fourth, detection and triage that run outside working hours, because the clocks do.
Qalea runs this as an operated function rather than handing over a checklist: continuous monitoring across endpoints and infrastructure, a SOC that triages and classifies as alerts fire, and a vCISO who owns the notification workflow and the relationship with the authority. That is the difference between a reporting obligation that becomes a scramble and one that runs as a rehearsed process. If your organisation is in scope for NIS2 or DORA and is not certain it could meet the first window today, that is the gap worth closing.
