Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAs of October 2026, CRA manufacturer reporting is already in force, even though most of the Cyber Resilience Act does not apply until December 2027. A single cyber incident may also trigger NIS2, DORA or GDPR duties, but each has its own covered entities, reporting threshold, clock and recipient. Do not treat filing under one regime as a substitute for checking the others.
Which reporting clock applies to each regime?
Start by identifying the legal role of the affected organisation, then test the event against that regime’s threshold. The deadlines below are not interchangeable: CRA and NIS2 use awareness-based stages, DORA’s initial deadline uses both classification and detection, and GDPR’s authority-notification deadline depends on the controller’s awareness of a qualifying personal-data breach.
As an Amazon Associate I earn from qualifying purchases.
| Regime | Who and what can trigger reporting? | Reporting sequence | Recipient and route |
|---|---|---|---|
| CRA | A manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting the security of its product with digital elements. | Early warning within 24 hours of awareness; full notification within 72 hours. For an actively exploited vulnerability, final report no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, final report within one month of the 72-hour notification. | Submit through the CRA Single Reporting Platform to the CSIRT in the Member State where the manufacturer has its main establishment. Information is normally made available simultaneously to ENISA and shared with relevant CSIRTs in other Member States. |
| NIS2 | An essential or important entity experiencing a significant incident affecting its services. | Early warning within 24 hours of awareness; incident notification within 72 hours; final report generally within one month of the incident notification. An intermediate report is due if requested. | The relevant national CSIRT or competent authority, according to national implementation and applicable sector rules. |
| DORA | An in-scope financial entity experiencing a major ICT-related incident. | Under the adopted technical standards’ summary, initial notification within four hours after classification and no later than 24 hours after detection; intermediate report at 72 hours; final report at one month. Article 19 also requires the final report when root-cause analysis is complete and actual impact figures are available. | The relevant competent authority. Member States may also require certain entities to report to NIS2 authorities or CSIRTs. |
| GDPR | A controller dealing with a personal-data breach likely to pose a risk to individuals’ rights and freedoms. A processor must notify its controller of every personal-data breach. | Controller notifies the supervisory authority without undue delay and no later than 72 hours after becoming aware, when the risk condition is met. A high-risk breach can also require communication to affected people. | The relevant supervisory authority; the controller separately assesses whether affected individuals must be told. |
When do I have to report a CRA incident?
Reporting began before the Act’s general application date
The Commission states that CRA Article 14 reporting obligations apply from 11 September 2026. The Act’s main provisions generally apply from 11 December 2027. The earlier reporting start matters: manufacturers should not wait for the general application date to establish their incident process.
The reporting duty concerns products with digital elements made available on the Union market, including products already placed on the market before 11 December 2027. The Commission says open-source software stewards’ reporting duties under Article 24(3) apply from 11 December 2027; that is a separate timing rule from manufacturers’ Article 14 reporting.
#1 Best Overall
Keep the two CRA final-report clocks separate
The final report depends on the kind of event. For an actively exploited vulnerability, the 14-day limit runs from when a corrective or mitigating measure becomes available. For a severe incident affecting product security, the one-month period runs from submission of the 72-hour notification. Do not record either as a generic one-month follow-up.
Use the CRA-specific platform
The Commission describes the CRA Single Reporting Platform as operational from 11 September 2026. A manufacturer submits once through that platform; the report is addressed to the CSIRT where the manufacturer has its main establishment. Unless exceptional circumstances apply, information is made available simultaneously to ENISA, and the receiving CSIRT shares it without delay with relevant CSIRTs in other Member States where the product was made available. A CSIRT may delay onward sharing on justified cybersecurity grounds in exceptional circumstances.
Use the platform’s current instructions and ENISA’s supporting FAQs, user guidance, glossary and training materials. A generic national breach form is not established as an interchangeable route for a CRA report.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat makes a NIS2 incident significant?
NIS2 reporting applies to essential and important entities when a significant incident affects their provision of services. Under the Directive’s test, an incident is significant if it has caused or is capable of causing severe operational disruption or financial loss for the entity, or if it has affected or is capable of affecting other people or entities by causing considerable material or non-material damage.
NIS2 is a directive implemented by Member States. The Commission set 17 October 2024 as the transposition deadline, but that date does not identify the form, portal or authority a particular entity must use. Check the relevant country’s current transposition, designated authority and sector-specific requirements. The NIS2 stages in the table are the usual sequence; national rules and the incident’s status can affect what is required next.
If the incident is still ongoing when the final-report stage arrives, Member States must ensure a progress report at that point and a final report within one month of handling the significant incident. NIS2 also provides for an intermediate report when requested.
What is the difference between a NIS2 significant incident and a DORA major incident?
The tests are not synonyms. NIS2 asks whether an incident meets its significant-impact test for an essential or important entity and its services. DORA applies to in-scope financial entities and requires reporting of major ICT-related incidents under DORA’s classification framework. An organisation should make and document each assessment that applies; it should not assume that a NIS2 classification automatically determines the DORA result.
DORA’s initial timing has two distinct limits: the adopted technical standards’ summary gives four hours after classification, with an outside limit of 24 hours after detection. These are not two alternative periods from the same trigger. The intermediate report is due at 72 hours, while the final report is tied to completion of root-cause analysis and availability of actual impact figures under Article 19. Confirm the applicable adopted reporting standards and competent authority’s filing instructions.
Who do I report a personal data breach to?
The GDPR distinguishes the processor’s duty from the controller’s regulatory assessment. A processor must notify its controller of every personal-data breach. The controller must assess whether the breach is likely to pose a risk to individuals’ rights and freedoms; only when that risk condition is met does the authority-notification deadline in the table apply.
A personal-data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. If the breach is likely to pose a high risk to individuals, the controller may also have to communicate it to affected people, unless the statutory exception applies—for example, effective technical and organisational protections or later measures mean the risk is no longer likely to materialise.
Record separately when the controller became aware, the basis and result of its risk assessment, whether supervisory-authority notification is required, whether individual communication is required, and when a processor notified the controller. Do not treat the GDPR rule as a requirement to report every security incident to a regulator.
Do I have 24 or 72 hours to notify?
That depends on the regime, role, trigger and stage. A 24-hour early warning under CRA or NIS2 does not replace the subsequent 72-hour report. DORA’s four-hour limit starts after classification and is also subject to a 24-hour maximum measured from detection. GDPR’s 72-hour period is for a controller’s authority notification after awareness of a personal-data breach that is likely to risk individuals’ rights and freedoms—not a universal deadline for every cyber event.
For each potentially applicable duty, record the trigger timestamp and the calculation separately. In particular, distinguish awareness from detection and classification rather than copying one incident timestamp into every reporting clock.
Can I submit one report for all four rules?
Not on the basis of the rules described here. CRA uses its own Single Reporting Platform, NIS2’s route depends on national implementation, DORA reports go to the relevant competent authority, and GDPR notices go to the relevant supervisory authority. A filing under one regime does not automatically discharge the others.
The European Commission’s Digital Omnibus proposal describes a single-entry reporting point spanning NIS2, GDPR, DORA, eIDAS and CER. It is a proposal, not evidence that a common filing route is already operative. The European Parliament Research Service briefing describes a proposed change to the GDPR notification deadline from 72 to 96 hours; the Commission’s live obligations guidance continues to state 72 hours. Keep the current rule and filing route in the runbook unless and until legislation is adopted and the relevant provisions apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to turn one incident into separate decisions
- Identify the affected entity and its legal role. Record whether it is a CRA manufacturer, NIS2 essential or important entity, DORA financial entity, GDPR controller or processor, and whether more than one role applies.
- Define the event precisely. Establish whether it concerns product security, service impact, an ICT-related incident, personal data, or several of these. A single technical event can involve distinct reportable facts under different regimes.
- Test each threshold independently. Document the CRA vulnerability or product-security impact assessment, the NIS2 significance assessment, the DORA major-incident classification, and the GDPR personal-data and risk assessment where applicable. Do not report automatically under every law simply because an incident occurred.
- Open a separate clock for each possible duty. Preserve the awareness, detection, classification and controller-awareness timestamps that matter. Note the deadline, stage and next report for each regime, including the separate CRA final-report trigger.
- Confirm the correct recipient and channel. Use the CRA Single Reporting Platform for CRA reporting. For NIS2, verify the applicable national and sector route; for DORA, the competent authority’s current instructions; and for GDPR, the relevant supervisory authority.
- Keep a decision and evidence record. Retain the facts used to assess scope and thresholds, incident timeline, clock calculations, submissions and acknowledgements, requested updates, mitigation or corrective measures, root-cause analysis, actual impact figures, and any decision not to notify under a regime with its rationale. Track customer or individual communications separately where required.
This is an operational coordination method, not a determination that a particular entity or incident falls within any regime. National implementation, sector-specific rules and the facts of the incident can change the applicable route or duty.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
