EU Incident Reporting Clocks: NIS2, DORA, GDPR, CRA, CER

A single cyber incident in the EU can start five different reporting clocks at once, each with its own trigger, threshold, recipient and penalty. A bank whose payment platform is hit by ransomware may owe DORA reports to its financial supervisor, a GDPR notification to its data protection authority and letters to customers, while the software vendor whose product was the entry point owes Cyber Resilience Act (CRA) reports to a CSIRT and ENISA. This page compares the EU regimes side by side: the NIS2 Directive, DORA, the GDPR, the CRA and the Critical Entities Resilience (CER) Directive. It is written for incident managers, privacy and compliance leads and CISOs who need one internal process that meets every clock, and it goes deeper on timing than the Cyber Incident Reporting Requirements Map, which covers global regimes at a summary level.

Key takeaways

The first clock is 4 to 24 hours, not 72. DORA wants an initial notification within 4 hours of classifying an incident as major (and no later than 24 hours from awareness), NIS2, the CRA and the CER Directive all want a first notice within 24 hours, and only the GDPR starts at 72 hours.
Triggers differ, so log each decision time. NIS2, the GDPR, the CRA and CER count from awareness; DORA counts from classification as major. Your incident record needs timestamps for detection, awareness, classification and every submission.
Several regimes can apply to the same event. DORA replaces NIS2 reporting for in-scope financial entities, but the GDPR runs in parallel for any personal data breach, and a product vendor's CRA duty is separate from its customers' duties.
Final reports land about a month later. NIS2, DORA and CER expect a full report roughly one month after the first notice; the CRA's final vulnerability report is due 14 days after a corrective measure is available.
A single reporting point is proposed, not live. The Commission's Digital Omnibus of 19 November 2025 proposes an ENISA single entry point and a 96-hour GDPR deadline; until it is adopted and operational, today's clocks apply unchanged.

Regulations and frameworks at a glance

Regime	Who reports	What triggers a report	Clock starts	Recipient	Status (8 November 2026)
NIS2 Directive (EU) 2022/2555, Article 23	Essential and important entities	Significant incident: severe operational disruption or financial loss, or considerable material or non-material damage to others	Awareness	National CSIRT or competent authority	In force since 16 January 2023; applies through national transposition laws
DORA Regulation (EU) 2022/2554, Article 19, with Delegated Regulation (EU) 2025/301	EU financial entities	Major ICT-related incident under the classification criteria in Delegated Regulation (EU) 2024/1772	Classification as major (with a 24-hour backstop from awareness)	Competent financial supervisor	Applies since 17 January 2025
GDPR Regulation (EU) 2016/679, Articles 33 and 34	Controllers (processors tell controllers)	Personal data breach, unless unlikely to result in a risk; individuals told where high risk	Awareness	Lead or competent supervisory authority; data subjects	In force; changes proposed in the Digital Omnibus
Cyber Resilience Act Regulation (EU) 2024/2847, Article 14	Manufacturers of products with digital elements	Actively exploited vulnerability, or severe incident affecting the product's security	Awareness	CSIRT coordinator and ENISA via the single reporting platform	Reporting applies from 11 September 2026; full application 11 December 2027
CER Directive (EU) 2022/2557, Article 15	Critical entities designated by Member States	Incident that significantly disrupts or could significantly disrupt an essential service	Awareness	Competent authority under the CER Directive	Member States had to identify critical entities by 17 July 2026; duties apply 10 months after an entity is notified

Scope: who and what is covered

The five regimes protect different things, which is why they overlap rather than duplicate. NIS2 and CER protect services, DORA protects the financial system, the GDPR protects people, and the CRA protects the users of products.

NIS2: medium and large entities in the sectors in Annexes I and II (energy, transport, banking, health, digital infrastructure, ICT service management, public administration and others), plus some entities regardless of size. Trust service providers, DNS and registries are notable digital entities. See the NIS2 Directive Guide for the size-cap rule.
DORA: banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities. For these entities DORA is the sector-specific act, so its incident rules apply in place of NIS2 Article 23. See the DORA and NIS2 Overlap Mapping Guide.
GDPR: every controller processing personal data in scope, in any sector and of any size. It applies on top of NIS2, DORA or CER whenever personal data is affected.
CRA: manufacturers placing products with digital elements on the EU market, including software and connected hardware, wherever the manufacturer is based. The duty sits with the product maker, not the customer running the product. See the EU Cyber Resilience Act Guide.
CER: entities named by their Member State as critical across 11 sectors. The CER Directive excludes banking, financial market infrastructure and digital infrastructure entities from most of its resilience and reporting chapters, because DORA and NIS2 already cover them. See the EU Critical Entities Resilience Directive Guide.

Which clocks can one incident start?

Organisation and event	NIS2	DORA	GDPR	CRA	CER
Hospital ransomware with patient records stolen	Yes, if significant	No	Yes	No (unless it makes and sells the affected product)	Yes, if designated critical and the service is disrupted
Bank payment outage after a supplier compromise, customer data exposed	No (DORA applies instead)	Yes, if major	Yes	No	No (banking excluded)
Software vendor finds its product actively exploited at customers	Possibly, if the vendor is itself an in-scope entity and the incident is significant	No	Only if the vendor's own personal data processing is breached	Yes	No
Energy grid operator loses SCADA availability	Yes, if significant	No	Usually no	No	Yes, if designated critical
Cloud provider credential theft affecting many customers	Yes, if significant	No (but its financial customers report under DORA)	Yes, as controller for its own data; as processor it tells its customers	Possibly, for its products with digital elements	No (digital infrastructure excluded)

Key obligations

The clocks side by side

Stage	NIS2 Art. 23(4)	DORA (2025/301 Art. 5)	GDPR Art. 33 and 34	CRA Art. 14	CER Art. 15
First notice	Early warning within 24h of awareness	Initial notification within 4h of classification as major, no later than 24h from awareness	Authority: without undue delay, where feasible within 72h of awareness	Early warning within 24h of awareness	Notification within 24h of awareness
Second notice	Incident notification within 72h of awareness	Intermediate report within 72h of the initial notification	Further information in phases without undue delay where not all is known	Notification within 72h of awareness	None fixed
Updates	Intermediate report on request of the CSIRT or authority	Updated intermediate report where the incident status changes	Phased updates	Intermediate report on request	None fixed
Final report	One month after the incident notification; progress report if still ongoing, then final within one month of handling	One month after the latest updated intermediate report	None (keep internal records of every breach under Art. 33(5))	Vulnerability: 14 days after a corrective measure is available; severe incident: one month after the 72h notification	Detailed report no later than one month, where relevant
People to tell	Service recipients affected, where appropriate	Clients, where the incident affects their financial interests (Art. 19(3))	Data subjects without undue delay where high risk, unless an Art. 34(3) exception applies	Affected users, and the public where needed	Not fixed in Art. 15; national law may add duties

What each first notice must say

NIS2 early warning: whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have cross-border impact. The 72-hour notification then adds an initial assessment of severity and impact and indicators of compromise where available. Trust service providers send that notification within 24 hours instead of 72.
DORA initial notification: the fields in the implementing technical standard templates, combined with intermediate and final reports in one form. The weekend rule lets some entities file by noon on the next working day, but not credit institutions, central counterparties, trading venues or entities that are essential or important under NIS2.
GDPR notification: the nature of the breach, categories and approximate numbers of people and records, the DPO contact, likely consequences and measures taken. If you file after 72 hours, give reasons for the delay.
CRA early warning: basic facts about the vulnerability or incident and, where known, the Member States affected. Reports go through ENISA's single reporting platform to the CSIRT of the manufacturer's main establishment, with ENISA notified at the same time. See the EU Cyber Resilience Act Vulnerability and Incident Reporting Guide.
CER notification: enough for the authority to judge cross-border effects. Significance is judged by the number of users affected, the duration and the geographical area affected.

Thresholds: what counts as reportable

Regime	Threshold test	Where the detail lives
NIS2	Severe operational disruption or financial loss, or considerable damage to others (Art. 23(3))	National law; Implementing Regulation (EU) 2024/2690 for digital infrastructure and digital providers
DORA	Critical services affected plus data loss, or two other criteria over thresholds (clients, duration, geography, economic impact, reputation)	Delegated Regulation (EU) 2024/1772, Articles 8 and 9
GDPR	Any breach unless unlikely to result in a risk; high risk for individuals	EDPB guidelines and national authority guidance
CRA	Actively exploited vulnerability; severe incident affecting the product's security	CRA Article 14 and ENISA single reporting platform guidance
CER	Significant disruption of an essential service (users, duration, geography)	CER Article 15 and national law

For DORA thresholds in detail, see the DORA Major ICT Incident Reporting Guide; for the NIS2 digital provider criteria, see the NIS2 Implementing Regulation 2024/2690 Guide.

Timeline and current status

Date	Milestone
16 January 2023	NIS2 and the CER Directive enter into force
17 January 2025	DORA applies, including Article 19 incident reporting
20 February 2025	Delegated Regulation (EU) 2025/301 on DORA report content and time limits published in the Official Journal
19 November 2025	Commission publishes the Digital Omnibus Regulation proposal, including a single entry point for incident reports
17 July 2026	Deadline for Member States to identify CER critical entities
11 September 2026	CRA reporting obligations apply; ENISA single reporting platform due to be operational
11 December 2027	CRA applies in full

Digital Omnibus: the proposal would create a single entry point run by ENISA, building on the CRA platform, so one notification could serve NIS2, the GDPR, DORA, the CER Directive, eIDAS and the CRA. For the GDPR it proposes moving authority notification from 72 to 96 hours and raising the threshold to breaches likely to result in a high risk, with the change applying only once the single entry point is operational (expected 18 to 24 months after entry into force). As at 8 November 2026 these remain proposals going through the legislative process; plan on the current clocks and watch for adoption.

National variation: NIS2 and CER are directives, so the exact forms, portals and sometimes the recipient differ by Member State. Check the NIS2 Transposition Tracker and the national guides, for example the Germany NIS2 Implementation Guide.

Enforcement and penalties

Regime	Maximum administrative fine for reporting failures	Who enforces
NIS2	Essential entities: a maximum of at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher; important entities: at least EUR 7 million or 1.4% (Art. 34(4) and (5), covering Articles 21 and 23)	National competent authorities
DORA	No fixed EU amount; Member States set administrative penalties and remedial measures (Art. 50)	Financial supervisors
GDPR	Up to EUR 10 million or 2% of worldwide annual turnover for breaches of controller obligations including Articles 33 and 34 (Art. 83(4))	Data protection authorities
CRA	Up to EUR 15 million or 2.5% of worldwide annual turnover for the tier covering the Article 14 reporting duties; no fines on micro and small enterprises for missing the 24-hour early warning	Market surveillance authorities
CER	Member States set effective, proportionate and dissuasive penalties (Art. 22)	CER competent authorities

NIS2 also makes management bodies accountable for risk management, and NIS2 Article 23(1) states that the act of notifying does not by itself expose an entity to increased liability. Late filing is easier to defend than silence: DORA expects you to tell the authority if you cannot meet a deadline, and the GDPR expects reasons for any delay.

What it means for AI agents and non-human identities

Most of the incidents that trigger these clocks now involve a machine identity somewhere in the chain: a leaked API key, a stolen OAuth token, a compromised CI/CD secret or an over-permissioned service account. The regimes do not mention non-human identities, but they apply in full when one is abused.

Awareness can come from a machine signal: a secret scanning alert, a cloud audit log showing a service principal acting from a new location, or a provider's notice that a token was leaked. Treat the time someone with authority confirms that signal as a probable incident as the awareness time, and record it.
Third-party token compromise is your incident too: when a SaaS integration's OAuth token is stolen at the provider, your data and service are affected. DORA allows reporting to be outsourced to a third party but leaves responsibility with the financial entity. See the Salesloft Drift breach for how one integration exposed many customers' data.
Agent actions need an audit trail: if an AI agent with delegated credentials deletes data or changes configuration, the 72-hour notification still needs a description of impact and indicators of compromise. Without per-agent identities and logs you cannot answer. See the AI Agent Observability and Incident Response Guide.
Containment evidence goes in the report: regulators ask what mitigation was applied. Record which keys, tokens and certificates were revoked or rotated and when; this also supports CRA reporting where your product's own embedded credentials were the weakness.
Reporting systems are identities too: portal accounts and API credentials used to file reports should be named, protected with MFA and not tied to one person who may be unavailable at 3am.

Compliance steps

Map your regimes. For each legal entity, list which of NIS2 (or DORA instead), GDPR, CRA and CER apply, the national recipient and the portal or channel. Keep the list in the incident response plan.
Build one classification step. At triage, ask four questions in order: is personal data affected, is a service significantly disrupted, is this major under DORA, and is one of our products exploited. Each yes starts a named clock.
Timestamp decisions, not just events. Record detection, awareness, DORA classification, GDPR risk assessment and every submission, with the decision maker's name.
Pre-fill templates. Keep draft early warnings with entity identifiers, contacts and sector details filled in, so the 4 or 24 hour notice is a 15-minute task.
Assign owners and deputies. Name who files for each regime, with out-of-hours cover and pre-approved authority to send a first notice without waiting for full facts.
Coordinate the story. One incident record should feed every report, so dates, impact numbers and root cause match across regulators. See the Incident Response Plan Template.
Exercise it. Run a tabletop where a single event triggers three regimes at once and measure time to each first notice. See the Cyber Incident Exercises Beyond Tabletop Guide.
Review after each incident. Compare actual submission times with the deadlines, record misses and their causes, and update thresholds and templates.

Measuring it

Time from awareness to first notice per regime, against the 4h, 24h and 72h limits.
Percentage of reports filed on time over 12 months, including final reports.
Classification lag: time from detection to the documented DORA or GDPR decision.
Consistency defects: mismatches in dates or impact figures between reports on the same incident.
Machine credential containment time: time from awareness to revocation of the abused key or token.

Practitioner checklist

List every EU regime that applies to each legal entity, with recipient, channel and deadline.
Confirm whether DORA replaces NIS2 reporting for your financial entities, and record the GDPR as parallel.
Add the four triage questions (personal data, service disruption, DORA major, product exploited) to your incident runbook.
Log awareness, classification and submission times with named decision makers.
Keep pre-filled first-notice templates for each regime and Member State.
Give out-of-hours staff authority to file a first notice with incomplete facts.
Name and protect the accounts and API credentials used to file reports.
Track final report due dates (one month, or 14 days after a CRA fix) in the incident ticket.
Record every key, token and certificate revoked during containment for the reports.
Watch the Digital Omnibus: update templates and the GDPR clock only once changes are adopted and in force.

Standards and references

This guide summarises EU incident reporting deadlines under NIS2, DORA, the GDPR, the CRA and the CER Directive as of 8 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Cyber Incident Reporting Requirements Map · NIS2 Directive Guide · DORA Major ICT Incident Reporting Guide · Data Breach Notification Checklist · Incident Response Guide

EU Incident Reporting Clocks: NIS2, DORA, GDPR, CRA and CER Deadlines Compared