- Meaning
- First of the three reporting stages
- Deadline
- Within 24 hours
- Recipient
- CSIRT or competent authority, via the national portal
- Content
- Brief initial report
- Updated
- June 2026
- Editorial team
- Compliance Compass
What is the early warning?
The Early warning is the first of the three reporting stages under the NIS2 reporting obligations. It tells the competent authority very early – before all the details are known – that a significant incident has occurred. Its purpose is not full clarification but the rapid triggering of a response: the authority should build a picture of the situation as early as possible and be able to warn other entities where necessary.
What gets reported
At this stage brief information is enough: that a significant incident has occurred, plus an indication of whether unlawful or malicious acts or a cross-border impact are suspected. A comprehensive assessment of severity and cause is expressly not required here – that follows with the incident notification. That keeps the early warning realistically achievable even under time pressure.
The three reporting stages
The early warning (24 h) is followed by the incident notification (72 h) and the Final report (one month). Together they form the three-stage chain of Reporting obligations, which Article 23 sets out and which each Member State handles through its own national portal.
A practical example
An example: late one afternoon an IT service provider finds that a crypto trojan is spreading across several customer systems. Instead of waiting for the full analysis, the team on duty files the early warning through the national portal that same evening: a significant incident, presumed criminal background. The 24-hour deadline is safely met, and the detailed assessment can then be worked out calmly for the 72-hour notification.
Why the 24 hours matter
The short deadline calls for preparation: only with clear responsibilities, a reachable reporting chain and an incident response plan can the early warning be filed in time. Hesitate here and you risk fines: Article 34 sets minimum ceilings of at least EUR 10 million or 2 % of total worldwide annual turnover for essential entities, and Member States may set higher amounts.
Further reading: Directive (EU) 2022/2555, early warning under Article 23(4)
Frequently asked questions
What is an early warning under NIS2?
The early warning is the first of the three NIS2 reporting stages after a significant incident and is due within 24 hours of becoming aware of it. It informs the CSIRT or the competent authority very early, before all the details are known, so that the authority can build a picture of the situation quickly and warn other entities where needed. The directive has applied since 18 October 2024; the channel through which you file is set by your own Member State.
What is the deadline for the early warning?
The early warning has a deadline of 24 hours from the moment you become aware of the significant incident. It is the first stage of the three-stage NIS2 reporting chain: the early warning after 24 hours is followed by the incident notification after 72 hours and the final report after one month. Missing the 24-hour deadline risks fines, for which Article 34 sets minimum ceilings of at least EUR 10 million or 2 % of total worldwide annual turnover for essential entities.
What does the early warning have to contain?
The early warning calls only for brief initial information that a significant incident has occurred, plus an indication of whether unlawful or malicious acts, or a cross-border impact, are suspected. A full assessment of severity and cause is expressly not required at this first stage. Detailed information and assessments follow only with the incident notification after 72 hours and the final report after one month.