Discuss your project

TOOLBOX · COMPLIANCE & NIS2

Calculate Reporting Deadlines.

Enter when you became aware of the incident and immediately see when the early warning, notification and final report are due under NISG 2026, plus the GDPR’s 72 hours. In Austrian time, not legal advice.

When Did You Become Aware of the Incident?

Becoming aware of the significant cybersecurity incident

Austrian time (Europe/Vienna). The 24 and 72 hours run from this moment, not from the start of the incident.

Notification already submitted or incident over?
Incident notification submitted to the CSIRT on

The final report is due one month after the notification was submitted.

Incident handling ended on

If the incident is still ongoing when the final report is due, the final report moves.

Stays in your browser: the details are calculated only on this device, not sent and not stored.

Your Deadlines

Enter the date and time you became aware of the incident. The deadlines appear immediately.

A calculation aid, not legal advice. Whether a significant cybersecurity incident exists is governed by Section 35 NISG 2026. The applicable German legal text is authoritative.

THE REPORTING CHAIN

24 Hours,
72 Hours,
One Month.

The three mandatory stages under Section 34(2) NISG 2026 and Article 23(4) of the NIS2 Directive, as in the download “NIS2: Security Incident Reporting Obligations at a Glance”.

  1. 01

    Early Warning

    Without undue delay, no later than 24 hours after becoming aware: where applicable, a suspicion of unlawful or malicious acts and any cross-border impact.

  2. 02

    Notification

    Without undue delay, no later than 72 hours after becoming aware: an update and initial assessment including severity and impact.

  3. 03

    Final Report

    No later than one month after the notification, not after the incident: root causes, mitigation measures, impact.

NEXT

Report
Prepared.

QUESTIONS

Good to Know.

When do the reporting deadlines start?

When you become aware of the significant cybersecurity incident, not when it began: the early warning is due no later than 24 hours afterwards and the notification no later than 72 hours afterwards (Section 34(2) items 1 and 2 NISG 2026, Article 23(4)(a) and (b) NIS2 Directive). Record the moment you became aware right away.

When is the final report due?

No later than one month after the notification was submitted, not after the incident (Section 34(2) item 4 NISG 2026). Without a notification time, the calculator uses the latest permitted time. If the incident is still ongoing by then, a progress report is due at that time and the final report one month after incident handling has ended (Section 34(2) item 5).

How does the calculator handle summer and winter time?

All times are Austrian time, even if your device is set differently. 24 and 72 hours run in real time; if a clock change falls in between, the clock shows one hour more or less at the end. A month ends on the same calendar day at the same time or, if that day does not exist in the following month, on its last day. This is a cautious calculation aid; how a deadline is calculated in an individual case is a matter for your legal advisor.

Does the reporting obligation apply to my company?

The obligation under Section 34 NISG 2026 applies to essential and important entities. The NIS2 applicability check shows whether you are one of them. Organizations outside the law can report incidents voluntarily to the national CSIRT (Section 37(2)).

Who receives the notification?

The sector-specific CSIRT responsible for you or, if there is none, the national CSIRT. The CSIRT forwards it to the cybersecurity authority (Section 34(1) NISG 2026). If personal data is affected, a separate notification goes to the Austrian Data Protection Authority (Article 33 GDPR, Section 18(1) DSG).

Does the calculator replace legal advice?

No. It calculates deadlines under the provisions mentioned. Whether a significant cybersecurity incident exists is governed by Section 35 NISG 2026 and, where applicable, Implementing Regulation (EU) 2024/2690; the calculator does not assess this.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result