{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-23","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-23)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:eu:ce0366","proof":"sha256:c8a8c85ba574b28e5463716f3880257129fc93aeccffff5861577eecd6fb8400","jurisdiction":"eu"},"brand_source":"Source: NovaCopilot","object_type":"article_agent","schema_version":"1.0.0","id":"agent:eu:nis2:art-23","act":"nis2-2022-2555","article":"23","text_sha256":"410a77bf8e69f9daa8c8bab487826a2f0761c8fdab6f0ee2bceec93dd9a3fdb0","obligations":["obligation:eu:nis2-2022-2555-art-23-essential-entity"],"agent":"agent:eu:nis2","name":"NovaCopilot NIS2 Agent, Article 23","title":{"en":"Reporting obligations","sv":"Rapporteringsskyldigheter","de":"Berichtspflichten"},"text":{"lang":"en","paragraphs":["1. Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 ( …","Where the entities concerned notify the competent authority of a significant incident under the first subparagraph, the Member State shall ensure that that competent authority forwards the notification to the CSIRT upon receipt.","In the case of a cross-border or cross-sectoral significant incident, Member States shall ensure that their single points of contact are provided in due time with relevant information notified in accordance with paragraph 4.","2. Where applicable, Member States shall ensure that essential and important entities communicate, without undue delay, to the recipients of their services that are potentially affected by a significant cyber threat any measures or remedies that those recipients are able to take in response to that threat. Where appropriate, the entities shall also inform those recipients of the significant cyber threat itself.","3. An incident shall be considered to be significant if:","(a)","it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;","(b)","it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.","4. Member States shall ensure that, for the purpose of notification under paragraph 1, the entities concerned submit to the CSIRT or, where applicable, the competent authority:","(a)","without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;","(b)","without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;"],"source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022L2555","read_at":"2026-08-18"},"sha256":"8eddc62c302711a12ec53c90f785982100b2007f2af74334ce8f0c0499ce3467","duties":[{"id":"obligation:eu:nis2-2022-2555-art-23-essential-entity","role":"essential-entity","duty":"Report significant incidents within the set deadlines."}],"applies_to_role":{"status":"verified","roles":["essential-entity"],"entity_types":[]},"applies_to_industry":{"status":"not_in_register","industries":[]},"cross_industry_chains":{"status":"verified","shape":"rule → obligation → control → industry","chains":[{"id":"chain:nis2~nis2-art.-23","rule":"nis2","obligation":"Incident reporting","control":"NIS2 art. 23","industries":["energy","financial-services","healthcare","industrials","technology"]}]},"revenue_exposure":{"status":"verified","sanction_article":"34","source_url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj","tiers":[{"article":"34(4)","basis":"min_of_max","percent_worldwide_turnover":2,"fixed_eur":10000000,"rule":"higher","applies_to":"essential_entities"},{"article":"34(5)","basis":"min_of_max","percent_worldwide_turnover":1.4,"fixed_eur":7000000,"rule":"higher","applies_to":"important_entities"}],"via":"article 34"},"links":{"article_page":"https://legal.exploreworldai.com/eu/rattsakter/nis2-2022-2555/artikel-23","regulation_agent":"https://legal.exploreworldai.com/api/public/v1/article-agents?reg=nis2","changes":"https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=nis2"},"llm_used":false,"hash":"sha256:c8a8c85ba574b28e5463716f3880257129fc93aeccffff5861577eecd6fb8400","version":"legal-2026-11-02","expires":"2026-11-04T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T16:22:18","content_hash":"sha256:c8a8c85ba574b28e5463716f3880257129fc93aeccffff5861577eecd6fb8400","revalidate_after":"2026-11-03T07:07:44.511Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-23","disclaimer":"Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.","content_notice":{"legal_advice":false,"nature":"Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.","kinds":{"official_text":"Officiell källtext, ordagrann och ej tolkad","summary":"Sammanfattning, ej juristgranskad. Läs alltid källtexten","classification":"Automatisk märkning ur källans egen text, ej juristgranskad"},"rule":"Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T06:07:44.511Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Anis2%3Aart-23","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1940}}