Resources
NIS2 and DORA incident reporting deadlines.
The reporting clocks that start when an incident is significant or major, in one place, each with its source.
NIS2 in Germany
Germany's NIS2 implementation has applied since December 2025, with no transition period. Reed Smith: Germany implements NIS2 with immediate effect
NIS2: 24 hours, 72 hours, one month
A significant incident needs an early warning within 24 hours, a notification within 72 hours and a final report within one month. NIS2 Directive (EU) 2022/2555, Article 23
DORA: four hours and 24 hours
A major ICT-related incident under DORA is reported within four hours of classification, and no later than 24 hours from becoming aware. openstatus: DORA incident reporting requirements
This page is not legal advice.