{"object_type":"card","schema_version":1,"id":"card:eu:article:nis2--art-23","core":{"id":"card:eu:article:nis2--art-23","subject":"eu:nis2--art-23","act":"nis2","article":"23","rule":[{"role":"essential-entity","duty":"Report significant incidents within the set deadlines."}],"authority":{"sanctioning":["National competent authority"],"supervisors":[{"name":"IMY: Sweden","url":"https://www.imy.se/"}]},"timeline":{"in_force":"2023-01-16","applies":"2024-10-17","deadlines":[{"obligation":"obligation:eu:nis2-art-23-essential-entity","hours":24,"days":null,"note":"24 h early warning, 72 h incident notification, final report within one month."}]},"provenance":{"source":"NIS2: Directive (EU) 2022/2555","source_url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj","eur_lex":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555","read_at":"2026-08-31"}},"core_hash":"893ac669eb8b2f3312830cd3958dae50a28a64b8877e732d4a28346eb526fc4e","extended":{"outcome":"not_in_register","action_kit":[{"obligation":"obligation:eu:nis2-art-23-essential-entity","provision":"nis2 art. 23","role":"essential-entity","action":"Report significant incidents within the set deadlines.","deadline":"24 hours","recipient":"CSIRT or competent cyber authority","verification":"authority_filing","verification_method":"Filing or publication can be shown with date and recipient.","evidence":["Filed report or declaration","Submission receipt or publication URL with date"],"exceptions":["exception:eu:nis2-size-cap"],"sanctions":["sanction:eu:nis2-art-34-4","sanction:eu:nis2-art-34-5"],"related_rules":["obligation:eu:ai-act-art-73-provider","obligation:eu:gdpr-art-33-controller","obligation:eu:gdpr-art-33-processor","obligation:eu:dora-art-19-financial-entity","obligation:eu:amlr-art-69-obliged-entity"],"source_url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"}],"timeline_dated":[],"affected_parties":[{"role":"essential-entity"}],"documentation_requirements":[{"kind":"report","role":"essential-entity","provision":"nis2 23","retention":null,"obligation":"obligation:eu:nis2-art-23-essential-entity"}],"risk_if_ignored":{"level":"high","sanctions":[{"id":"sanction:eu:nis2-art-34-4","type":"administrative_fine","authority":"National competent authority","max_amount":"EUR 10 000 000","max_turnover_pct":2},{"id":"sanction:eu:nis2-art-34-5","type":"administrative_fine","authority":"National competent authority","max_amount":"EUR 7 000 000","max_turnover_pct":1.4}]},"related_rules":["card:eu:article:nis2--art-20","card:eu:article:nis2--art-21","card:eu:article:ai-act--art-73","card:eu:article:amlr--art-69","card:eu:article:dora--art-19","card:eu:article:gdpr--art-33"],"related_cases":"not_in_register","precedent":"not_in_register","comparison_objects":[{"jurisdiction":"SE","kind":"transposition","instrument":"Cybersäkerhetslag","identifier":"SFS 2025:1506","url":"https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/cybersakerhetslag-20251506_sfs-2025-1506/"},{"jurisdiction":"FI","kind":"transposition","instrument":"Kyberturvallisuuslaki","identifier":"124/2025","url":"https://www.finlex.fi/fi/lainsaadanto/saadoskokoelma/2025/124"},{"jurisdiction":"DE","kind":"transposition","instrument":"BSI-Gesetz (NIS-2-Umsetzungsgesetz)","identifier":"BSIG","url":"https://www.gesetze-im-internet.de/bsig_2025/"},{"jurisdiction":"NO","kind":"transposition","instrument":"Lov om finansavtaler (finansavtaleloven)","identifier":"LOV-2020-12-18-146","url":"https://lovdata.no/dokument/NL/lov/2020-12-18-146"},{"jurisdiction":"DK","kind":"transposition","instrument":"Lov om betalinger","identifier":"LOV nr 652 af 08/06/2017","url":"https://www.retsinformation.dk/eli/lta/2017/652"},{"jurisdiction":"UK","kind":"not-applicable","instrument":"not_in_register","identifier":"not_in_register","url":"https://www.legislation.gov.uk/"}],"change_history":[{"day":"2026-08-31","type":"rechecked","event":"Raden läst mot EUR-Lex utan ändring","hash_after":"bc6e9a1f8fff8f1d"},{"day":"2024-10-17","type":"changed","event":"Sista dag för genomförande i nationell rätt","hash_after":"bc6e9a1f8fff8f1d"},{"day":"2023-01-16","type":"added","event":"Rättsakten trädde i kraft enligt CELEX 32022L2555","hash_after":"bc6e9a1f8fff8f1d"}]},"links":[{"id":"obligation:eu:nis2-art-23-essential-entity","type":"obligation","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:nis2-art-23-essential-entity"},{"id":"sanction:eu:nis2-art-34-4","type":"sanction","url":"https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:nis2-art-34-4"},{"id":"sanction:eu:nis2-art-34-5","type":"sanction","url":"https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:nis2-art-34-5"},{"id":"authority:eu:national-competent-authority","type":"authority","url":"https://legal.exploreworldai.com/api/public/v1/obj/authority/eu:national-competent-authority"},{"id":"action_kit:eu:nis2--art-23","type":"action_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:nis2--art-23"},{"id":"card:eu:article:ai-act--art-73","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-73"},{"id":"card:eu:article:amlr--art-69","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:amlr--art-69"},{"id":"card:eu:article:dora--art-19","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:dora--art-19"},{"id":"card:eu:article:gdpr--art-33","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:gdpr--art-33"},{"id":"timeline:eu:nis2","type":"timeline","url":"https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:nis2"}],"link_count":{"total":13,"public":10,"meets_target":true},"next_questions":{"items":[{"question":"What does Article 73 AI-ACT require?","card":"card:eu:article:ai-act--art-73","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-73&view=compact"},{"question":"What does Article 69 AMLR require?","card":"card:eu:article:amlr--art-69","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:amlr--art-69&view=compact"},{"question":"What does Article 19 DORA require?","card":"card:eu:article:dora--art-19","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:dora--art-19&view=compact"},{"question":"What does Article 33 GDPR require?","card":"card:eu:article:gdpr--art-33","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:gdpr--art-33&view=compact"},{"question":"What does Article 20 NIS2 require?","card":"card:eu:article:nis2--art-20","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:nis2--art-20&view=compact"}],"count":5,"meets_target":true},"method":"Composed with fixed rules from the obligation, sanction, action kit, timeline, documentation, outcome, judgment reference, national implementation and change journal registers. Missing fields are not_in_register.","attribution":"Source: NovaCopilot","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/card","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"links_full":13},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T05:33:35.897Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/card?id=card%3Aeu%3Aarticle%3Anis2--art-23","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":2533}}