Governance and regulation

NIS2 incident reporting starts with entity scope—not a universal timer

Directive (EU) 2022/2555 establishes staged reporting duties for significant incidents, but the operating clock depends on entity scope, national transposition, competent authority, awareness, significance, and the facts of the incident.