NIS2 reporting deadline calculator
Early warning, incident notification and final report under § 32 BSIG with date and time. Free, no sign-up, your inputs are not stored.
When is an incident significant?
Essential and important entities must report significant incidents. An incident is significant if it has caused or can cause severe operational disruption of the services or financial loss, or if it has affected or can affect other persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG). For certain digital services, Implementing Regulation (EU) 2024/2690 sets out specific criteria. More in the guide to NIS2 reporting
Frequently asked questions about NIS2 reporting deadlines
Who has to report under NIS2?
Essential and important entities under § 28 BSIG. The free applicability check shows whether your company is one of them.
What does “without undue delay” mean?
The 24 and 72 hours are maximum periods. Report as early as you carefully can.
What applies if the incident is still ongoing after one month?
Then you submit a progress report at that point instead of the final report. The final report follows once the incident has been fully handled (§ 32(2) BSIG).
Why does the calculator behave differently across the clock change?
A 24-hour deadline ends after 24 real hours. If the clock changes in between, the clock shows one hour earlier or later at the end than at the start.
Are my inputs stored?
No. The calculation happens only in memory and is neither stored nor logged.
Do I also have to report under the CRA or the GDPR?
Possibly, with their own deadlines and to other bodies. For manufacturers of products with digital elements there is the free CRA reporting deadline calculator.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.