AI Governance Engineer
GitHub

NIS2 Art. 23: significant-incident reporting

An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month of the notification, incl. the root cause

By Reviewed

From clause to evidenceThe chain from NIS2 Art. 23 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: NIS2 Directive (EU) 2022/2555, Art. 23ClauseNIS2Art. 23Duty holder: Essential and important entitiesDuty holderEssential andimportant…Applies from: 2024-10-18 (In force)Applies from2024-10-18In forceArtefact: Per-regime clock on the incident record; significance determination with an owner; cause coding reused in the final reportArtefactPer-regimeclock…Layer: Layer 05 Assurance & Continuous ComplianceLayerLayer 05Assurance &ContinuousComplianceEvidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from NIS2 Art. 23 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: NIS2 Directive (EU) 2022/2555, Art. 23ClauseNIS2 · Art. 23Duty holder: Essential and important entitiesDuty holderEssential and important entitiesApplies from: 2024-10-18 (In force)Applies from2024-10-18 · In forceArtefact: Per-regime clock on the incident record; significance determination with an owner; cause coding reused in the final reportArtefactPer-regime clock…Layer: Layer 05 Assurance & Continuous ComplianceLayerLayer 05Assurance & Continuous ComplianceEvidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-NIS2-ART23. Drawn from chapter 08.
Text alternative
  • Clause: NIS2, Art. 23.
  • Duty holder: Essential and important entities.
  • Applies from: 2024-10-18, In force.
  • Artefact: Per-regime clock….
  • Layer: Layer 05 Assurance & Continuous Compliance.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
When this obligation appliesThe date of AIGE-OBL-NIS2-ART23 on a time axis, against its review date 2026-09-24.2024202620282030As of 2026-09-242024-10-18 · In forceMember States apply theirmeasures from 2024-10-18;binds through national law2024-10-18 · In force · Member States apply their measures from 2024-10-18; binds through national lawSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-NIS2-ART23 on a time axis, against its review date 2026-09-24.2024-10-18 · In forceMember States apply their measures from2024-10-18; binds through national law2024202620282030As of 2026-09-242024-10-18 · In force · Member States apply their measures from 2024-10-18; binds through national lawSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-NIS2-ART23
DateStepDetail
2024-10-18In forceMember States apply their measures from 2024-10-18; binds through national law
Id
AIGE-OBL-NIS2-ART23
Instrument
NIS2 Directive (EU) 2022/2555 law
Clause
Art. 23
In scope
Essential and important entities
Authority
CSIRT or competent authority
Applies from
In force · Member States apply their measures from 2024-10-18; binds through national law

The artefact that evidences it

Per-regime clock on the incident record; significance determination with an owner; cause coding reused in the final report.

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

Source

Chapter 08, section Cyber-security and incident-reporting law, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). NIS2 Art. 23: significant-incident reporting (AIGE-OBL-NIS2-ART23). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-nis2-art23. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{NIS2 Art. 23: significant-incident reporting (AIGE-OBL-NIS2-ART23)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-nis2-art23},
  note         = {Version 0.5.0}
}