{"object_type":"business_agent","schema_version":1,"title":"NIS2 significant incident reporting","core":{"id":"agent:eu:business:nis2-incident-reporting","jurisdiction":"eu","domain":"compliance","question":"What must we report under NIS2 after a cyber incident?","affected_business":["Essential or important entity"],"applies_when":"Essential and important entities in the sectors of Annexes I and II, generally medium-sized or larger.","decision":"Yes, significant incidents must be reported to the CSIRT or competent authority.","obligation":"Submit an early warning, an incident notification and a final report; management bodies approve and oversee risk measures.","action":["Classify the incident as significant or not","Send the early warning","Send the incident notification","Submit the final report"],"deadline":"Early warning within 24 hours, notification within 72 hours, final report within one month of the notification.","sources":[{"provision":"NIS2 Art. 23(4)","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555"},{"provision":"NIS2 Art. 20","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555"},{"provision":"NIS2 Art. 34(4)","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555"}],"read_at":"2026-10-15"},"sha256":"1b4d1eb5ef0ef54dd26cfcd1ae47d1ca1e5fb964ee1609ca53cc2d821f660536","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Essential or important entity"],"applies_when":"Essential and important entities in the sectors of Annexes I and II, generally medium-sized or larger.","decision":"Yes, significant incidents must be reported to the CSIRT or competent authority.","obligation":"Submit an early warning, an incident notification and a final report; management bodies approve and oversee risk measures.","risk":{"risk_level":"high","risk_factors":["fine_cap_pct_turnover"]},"action":["Classify the incident as significant or not","Send the early warning","Send the incident notification","Submit the final report"],"deadline":"Early warning within 24 hours, notification within 72 hours, final report within one month of the notification.","verification":{"sha256":"1b4d1eb5ef0ef54dd26cfcd1ae47d1ca1e5fb964ee1609ca53cc2d821f660536","read_at":"2026-10-15","sources":["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555"],"source":"Source: NovaCopilot"},"next_questions":["Must a manufacturer report exploited vulnerabilities in its products?"],"related":[{"id":"eu:nis2","type":"action_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:nis2"},{"id":"agent:eu:business:cra-vulnerability-reporting","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:cra-vulnerability-reporting"}],"related_count":2,"page":"https://legal.exploreworldai.com/en/business-agents/eu-nis2-incident-reporting","version":"1b4d1eb5ef0ef54d","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"3254c7afa4a5a739","risk_version":"a5ce36e019b9029b","decision_version":"bf186158b28ab85c","package_version":"e1b16760d2bc919a","change_score":0.25,"changed_dimensions":["package"],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[{"dimension":"package","version":"1d62bb5ea6ffd73f","until":"2026-10-15"}],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Anis2-incident-reporting","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"withheld":{"links_full":2,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T23:18:42.042Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aeu%3Abusiness%3Anis2-incident-reporting","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1304}}