Cyber incident reporting

1. Immediately Incident notification
2. 72 hours Maximum period for the notification

Notes: The duty is in Article 20-G of the Organic Law on Digital and Audiovisual Transformation, inserted by the law published in the Registro Oficial on 22 May 2026 and in force from that day. A notification made in good faith and on time cannot be used on its own as proof of negligence. Within six months of publication MINTEL must adopt the regulation on incident management and notification, together with the national CSIRT and without duplicating the channels of sectors that have a specialised supervisory body.

1. Immediately Incident declaration

Notes: The NIS2 transposition bill (on the resilience of critical infrastructure), adopted by the Senate in March 2025, still awaits its plenary debate in the National Assembly, which was withdrawn from the agenda on 6 October 2026 and has not yet been rescheduled; once adopted, the 24-hour, 72-hour and one-month scheme will apply.

1. Immediately Initial notification
2. 6 hours First supplementary information
3. 14 days Full details

Notes: The deadlines are set by the Cyber Security (Notification of Cyber Security Incident) Regulations 2024.

1. Immediately Inform the National CERT
2. 72 hours Reporting deadline

Notes: The duty is in section 21 of the Act. The amendment signed on 28 February 2024 replaced the 7-day deadline from occurrence with 72 hours from detection and provided for reporting through sectoral CERTs or SOCs.

1. Immediately Incident or vulnerability notification

1. 1 hour Critical infrastructure operators
2. 2 hours Central and state bodies and their directly affiliated units
3. 4 hours Other network operators
4. 30 days Final report (from the end of incident handling)

Notes: Measures of the Cyberspace Administration of 11 September 2025, in force since 1 November 2025 (Articles 4 and 8). For major and particularly major incidents, the body receiving the report must inform the national level within 30 minutes (critical infrastructure) or within 1 hour. Details that cannot be established within the deadlines may be supplied later; reports can also be made through the 12387 hotline.

1. 1 hour Notification of the most serious incidents (category 2)
2. 6 hours Notification of other incidents (category 1)

Notes: Incident categories and deadlines are set by Prime Ministerial Decree 81/2021. Prime Ministerial Decree 111/2025, in force since 16 August 2025, added to table 1 a category for incidents caused by improper use of ICT assets, without changing the deadlines.

1. 1 hour Incident notification
2. 36 hours Damage control or recovery completed and reported, for major incidents (72 hours for level 1 or 2 incidents)
3. 1 month Investigation, handling and corrective action report (from completion of damage control or recovery)

Notes: The Act as revised in 2025 has been in force since 1 December 2025. The deadlines are set by the Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents, amended on 5 January 2026.

1. 2 hours Incident notification
2. 72 hours Supplementary details
3. 30 days Final report (after the supplementary details)

Notes: Deadlines as set out by the Cyber Security Agency (CSA) for CII owners and for providers designated as responsible for third-party-owned CII. Since 31 October 2025, incidents suspected of being caused by advanced persistent threats (APTs) and incidents in the owner's systems not connected to the CII that disrupt the essential service must also be reported within 2 hours; for incidents in systems not connected to the CII there is also a consolidated quarterly report, due by the third working day after the end of the quarter. Since the same date CSA can designate systems of temporary cybersecurity concern (STCCs), whose owners must report incidents during the period specified.

1. 3 hours Early alert
2. 72 hours Second report (24 hours for OIV whose essential service is affected)
3. 7 days Action plan (OIV only)
4. 15 days Final report (from the early alert)

Notes: The reporting procedure is governed by Supreme Decree 295/2024. The reporting duty (Article 9) and the penalties apply from 1 March 2025. The UTM is a Chilean inflation-indexed unit of account.

1. 3 hours First notice of the significant incident or threat
2. 24 hours Early warning
3. 72 hours Incident notification
4. 1 month Final report (from the notification)

Notes: The obligations are in Article 33 of the Law (Služben vesnik No 135 of 4 July 2025), which aligns with NIS2 and applies from 1 January 2026. Trust service providers report within 24 hours; users exposed to a serious threat must be informed by the next working day. If the notice reaches the competent authority instead, it forwards it to the CSIRT within two hours.

1. 4 hours Initial notification (from classification as major, no later than 24 hours from awareness)
2. 72 hours Intermediate report (from the initial notification)
3. 1 month Final report

Notes: The deadlines are set by Delegated Regulation (EU) 2025/301. For financial entities DORA takes precedence over NIS2.

1. 6 hours Incident report

1. 12 hours Critical incident with significant impact (if oral, in writing within 84 hours)
2. 72 hours Other incident with relevant impact (if oral, in writing within 48 hours)

1. 12 hours Notification of serious incidents (disrupting or likely to disrupt core functions)
2. 48 hours Notification of other incidents
3. 14 days Written report

Notes: The Ordinance has been in operation since 1 January 2026 and is enforced by the Commissioner's Office set up within the Security Bureau. If the first notice is not given in the specified form and way, it must be completed in that form within 48 hours.

1. 24 hours Early warning
2. 72 hours Incident notification
3. 1 month Final report (from the notification)

Notes: This is the common EU scheme (Article 23); the actual obligations come from the national transposition laws, listed below for the countries covered.

1. 24 hours Early warning of the actively exploited vulnerability
2. 72 hours Vulnerability notification
3. 14 days Final report (from when a corrective or mitigating measure is available)
4. Without undue delay Inform the impacted users

Notes: Article 14(2). The early warning and the notification run from when the manufacturer becomes aware of the vulnerability; users must be informed without undue delay, where possible in a machine-readable format. It applies from 11 September 2026, before the rest of the regulation (11 December 2027); since that date notifications are submitted through the Single Reporting Platform (SRP) run by ENISA, at portal.cra-srp.enisa.europa.eu. The situation in each Member State is on the CRA implementation page.

1. 24 hours Early warning of the severe incident
2. 72 hours Incident notification
3. 1 month Final report (from the incident notification)
4. Without undue delay Inform the impacted users

Notes: Article 14(4). An incident is severe if it negatively affects, or is capable of affecting, the product's ability to protect data and functions, or has led to the introduction of malicious code. CRA reports do not replace NIS 2 reports where the manufacturer is also a NIS 2 entity. Since 11 September 2026 these notifications are also submitted through ENISA's Single Reporting Platform (SRP).

1. 24 hours Early warning (exploited vulnerability or severe incident)
2. 72 hours Notification
3. 14 days Final vulnerability report (from the fix)
4. 1 month Final incident report (from the notification)

Notes: The deadlines are those of the regulation; the national law designates the authorities and lays down the penalties.

1. 24 hours Early warning (exploited vulnerability or severe incident)
2. 72 hours Notification
3. 14 days Final vulnerability report (from the fix)
4. 1 month Final incident report (from the notification)

Notes: The reporting obligations apply directly from 11 September 2026 and the BSI already coordinates reports as CSIRT. The implementing law, passed by the Bundestag on 15 October 2026, awaits the Bundesrat (next plenary sitting on 20 November 2026) and promulgation; its reporting provisions will enter into force the day after promulgation.

1. 24 hours Early warning
2. 72 hours Incident notification
3. 1 month Final report (from the notification)

1. 24 hours Incident report
2. 72 hours Report of vulnerabilities found in audits and assessments (from discovery of the vulnerability)

Notes: The duty is in paragraph 5.3 of the Directive, in force since 1 October 2021, which implements section 39(1) of Act 1038. The owner must also designate a point of contact for reports and for receiving security advisories.

1. 24 hours Early warning (exploited vulnerability or severe incident)
2. 72 hours Notification
3. 14 days Final vulnerability report (from the fix)
4. 1 month Final incident report (from the notification)

Notes: The reporting obligations apply directly from 11 September 2026. The draft decree (preliminary reading by the Council of Ministers on 2 October 2026; in the Chamber of Deputies the joint Constitutional Affairs and Transport Committees must give their opinion by 18 November 2026) designates ACN as notifying and market surveillance authority and also lets consumers report vulnerabilities and incidents to CSIRT Italia.

1. 24 hours Early warning
2. 72 hours Incident notification
3. 1 month Final report (from the notification)

Notes: The reporting duty applies from January 2026 to entities already listed; for those added to the list in 2026, from 1 January 2027.

1. 24 hours Initial report
2. 72 hours Full notification

Notes: Entities covered by NIS2 follow the rules of Legislative Decree 138/2024. The incidents to report are those in the taxonomy adopted by ACN on 9 February 2026 (in force since 17 February 2026); a notification made under NIS2 also satisfies Law 90/2024.

1. 24 hours Early warning
2. 72 hours Incident notification
3. 1 month Final report (from the notification)

Notes: The duty is laid down in Article 6 of the Act, in force since 1 February 2025; the NIS2 Directive applies there as national law until it is incorporated into the EEA Agreement. Where sector legislation provides for a notification with at least equivalent criteria, that one applies and its recipient forwards it without delay to the Stabsstelle Cyber-Sicherheit. Affected service recipients must also be informed without delay.

1. 24 hours Initial notification
2. 72 hours First report on medium- or high-level incidents (from the initial notification)
3. 30 days Final report (from resolution of the incident)

Notes: The obligations are in Articles 28-34 of the Law (Službeni list CG 113/2024), in force since 5 December 2024 and aligned with NIS2. The incident level (low, medium or high) is set by the Agency or the CIRT after the initial notification; while the incident lasts, reports follow every 72 hours for medium-level incidents and every 24 hours for high-level ones. Threats and incidents with no impact on service continuity are reported in a monthly report.

1. 24 hours Notice (varsel)
2. 72 hours Update of the notice
3. 1 month Incident report (from the notice)

Notes: The deadlines are set by § 17 of the Digital Security Regulation (digitalsikkerhetsforskriften) of 20 June 2025, in force together with the Act since 1 October 2025; the Act requires notification without undue delay. NSM is the national single point of contact and the national incident response centre. The Act implements Directive (EU) 2016/1148 (NIS) under the EEA Agreement.

1. 24 hours Incident notification
2. 15 days Final report (from the end of the incident)

Notes: The obligations are in Articles 13, 14 and 24 of the Law, in force since 31 October 2025; for operators designated under the 2016 law, the old obligations remained in force until 31 December 2025. While the incident lasts, reports must be sent every three days for medium-level incidents and every 24 hours for high- and very high-level ones; affected users must be informed without delay. The Information Security Office starts operating on 1 January 2027; until then its tasks are carried out by the Office for Information Technologies and eGovernment and, for the national CERT, by RATEL.

1. 24 hours Cyberattack report

1. 24 hours Ransom payment (from the payment)
2. 72 hours Covered cyber incident

Notes: The obligations start only with CISA's final rule, which the Fall 2025 federal regulatory agenda scheduled for September 2026. On 1 October 2026 the final rule was submitted for review to the White House Office of Information and Regulatory Affairs (OIRA), a review still under way in late October 2026, so the rule has not yet been published in the Federal Register. In 2026 CISA held town hall meetings to refine the scope and burden of the 2024 proposal.

1. 48 hours Notification of critical-level incidents

Notes: The obligations are in Articles 18 and 32 of the Regulation, published on 4 November 2025 and in force 90 days later, in early February 2026. Deadlines for the other levels are set by the incident classification of the Secretariat of Government and Digital Transformation (SGTD-PCM). Personal data breaches must also be notified to the data protection authority (ANPD).

1. 72 hours Payment report (from the payment or from becoming aware of it)

Notes: Part 3 of the Act, which contains the obligation, commenced on 29 May 2025, at the end of the six months from Royal Assent (29 November 2024). The turnover threshold and the content of the report are set by the Cyber Security (Ransomware Payment Reporting) Rules 2025.

1. 72 hours Incident report to the CSE (maximum period; the exact one will be set by regulations)

Notes: Part 2 of the Act, which received Royal Assent on 15 June 2026, will come into force by order of the Governor in Council, and regulations will set the exact deadline. Immediately after reporting to the CSE, the operator must also notify the appropriate regulator.

1. 72 hours Incident notification

Notes: The Cyber Security and Resilience (Network and Information Systems) Bill, which amends these rules, provides for an initial notification within 24 hours and a full one within 72 hours, also to the NCSC. It completed report stage in the House of Lords on 26 October 2026 and third reading is set for 2 November 2026, followed by any consideration of amendments in the Commons and Royal Assent.

1. 4 days Public disclosure on Form 8-K (4 business days from the materiality determination)

Notes: Materiality must be determined without unreasonable delay after discovery of the incident; information not available at the time is added by amending the Form 8-K within 4 business days after it becomes available. Disclosure may be delayed if the US Attorney General determines that it poses a substantial risk to national security or public safety. Compliance required from 18 December 2023 and, for smaller reporting companies, from 15 June 2024.

1. Without undue delay First report with the information available
2. 30 days Full report

Notes: The duty is set by Article 5 of the Act and detailed in Article 4 of the joint ministerial ordinance No. 4 of 28 May 2026, both in force since 1 October 2026. Events occurring within six months of the operator's designation, among others, need not be reported.

1. Without undue delay Initial notification, then updates and a final notification

Notes: The preliminary draft NIS2 transposition law (Ley de Coordinación y Gobernanza de la Ciberseguridad), approved at first reading by the Council of Ministers on 14 January 2025, was never sent to the Cortes, which were dissolved on 6 October 2026 with elections on 29 November 2026; transposition therefore passes to the new legislature, and Royal Decree-Law 12/2018 remains in force meanwhile.