One incident, several clocks: reporting without missing anything across NIS2, DORA, GDPR and the CRA

Up to date as of October 25, 2026. The NIS2 directive has not yet been transposed in France, and the single reporting point proposed by the European Commission has not been adopted. This article will be updated as these develop.

Ransomware hits an insurance company on a Friday evening. Customer data is encrypted and probably exfiltrated, several services are down, and the company has cyber insurance. Before the attack is even understood, several countdowns have started: the financial authority’s, the CNIL’s (the French data protection authority), the insurer’s… and soon ANSSI’s under NIS2.

Each regulation was designed with its own logic. It is up to the victim organization to turn them into a single procedure that can be followed in the middle of a crisis.

The main deadlines

Text	Who is covered	Recipient	First deadlines	Final report
NIS2 (Directive 2022/2555)	Essential and important entities, once the French law is adopted	ANSSI	Early warning within 24 h, notification within 72 h	Within one month
DORA (Regulation 2022/2554)	Banks, insurers, investment firms and other financial entities	Competent authority (ACPR or AMF depending on the entity)	Initial notification within 4 h of classifying the incident as “major”, and no later than 24 h after becoming aware of it; intermediate report within 72 h	No later than one month after the last intermediate report
GDPR (Articles 33 and 34)	Every data controller	CNIL; the data subjects in the event of a high risk	Notification within 72 h, unless the breach is unlikely to result in a risk	Additional notification possible; internal register of breaches
CRA (Regulation 2024/2847, Article 14)	Manufacturers of products with digital elements	Coordinating CSIRT and ENISA, via the single reporting platform	Early warning within 24 h, notification within 72 h	14 days after a corrective measure is available (actively exploited vulnerability) or one month (severe incident)
Cyber insurance (French Insurance Code, Article L. 12-10-1)	Companies that are victims of a cyberattack and insured against that risk	Police, gendarmerie or public prosecutor (filing a complaint)	Complaint within 72 h of becoming aware of the attack, a condition for compensation	—

Until NIS2 is transposed, the existing French regimes continue to apply: operators of vital importance and the operators of essential services designated under the first NIS directive must already report certain incidents to ANSSI without delay. The CRA reporting obligations have applied since September 11, 2026, and those of DORA since January 17, 2025.

What the table does not say

The clocks do not start at the same moment

Under the GDPR, the 72-hour deadline runs from the moment the organization is reasonably certain that an incident has affected personal data. Under DORA, the 4-hour deadline starts when the incident is classified as major, within a limit of 24 hours after becoming aware of it. For insurance, what counts is becoming aware of the attack. Hence the importance of timestamping every step: detection, qualification, decisions.

The thresholds are not the same

A “significant” incident under NIS2, a “major” incident under DORA (according to the criteria of Delegated Regulation 2024/1772), a data breach that poses a risk to individuals, an actively exploited vulnerability under the CRA: the same event can cross one threshold and not another. Qualification must therefore be done regime by regime.

The expected content changes over time

Under NIS2, the early warning only asks for a few pieces of information: is the incident suspected of being malicious, and could it have a cross-border impact? The final report requires the root cause analysis, the measures taken and the impact, including cross-border impact. It is better to know from the outset what information will have to be gathered.

Your suppliers are part of the chain

An incident at an IT service provider can trigger your own obligations. But it still has to warn you in time: NIS2 and DORA both require you to manage third-party risk, which means notification clauses in contracts.

Organizing a single decision chain

A common qualification matrix: for each type of incident, the applicable regimes, the triggering criteria and the recipients. It is validated in advance, in calm conditions, with the legal team, the DPO and compliance.
Clear roles: who qualifies, who decides, who notifies, who signs, with deputies who can be reached 24 hours a day, 7 days a week.
Systematic timestamping in the incident management tool, to prove that deadlines were met.
Ready-to-use access and templates: accounts created on the online services (CNIL, ANSSI, financial authority, ENISA platform for manufacturers), pre-filled message templates.
Regular exercises, stopwatch in hand, including the legal teams and management.

The role of the SOC and playbooks

The SOC is on the front line: it detects, qualifies technically and documents. Orchestration tools (SOAR) can industrialize much of the mechanics:

alerting the crisis team as soon as an incident is qualified;
starting one countdown per applicable regime, with reminders before each deadline;
pre-filling the factual elements of the notifications from the ticket data (scope, affected systems and data, timeline);
logging every action to build the evidence file.

The decision to notify, however, remains a human one: it commits the organization and rests on a legal assessment.

Towards a single European reporting point?

In its “Digital Omnibus” proposal of November 19, 2025, the European Commission plans a single entry point, managed by ENISA, for reporting incidents under NIS2, the GDPR, DORA, the eIDAS regulation and the directive on the resilience of critical entities. It would change neither the recipients nor the content of the notifications. The proposal also considers extending the deadline for notifying data breaches under the GDPR to 96 hours.

In October 2026, this text is still being negotiated, and its use would only become mandatory about 18 months after its entry into force. Current procedures therefore remain fully valid.

Where to start

List the regimes that apply to you: business sector, data processed, products sold, insurance contract.
Write the qualification matrix and have it validated by the legal team, the DPO and compliance.
Appoint the decision-makers and their deputies, reachable at any time.
Prepare the access and the notification templates for each recipient.
Build the countdowns into your incident management tools and your playbooks.
Review your contracts: supplier notification clauses, the terms of your cyber insurance.
Exercise the chain at least once a year, on a realistic scenario.

For the details of the NIS2 obligations, see our analysis NIS2 in France: preparing without waiting for the transposition law.

Sources

← All insights