One incident can start several legal clocks at once. Enter the moment you became aware, tick the regimes that apply, and get every deadline on one timeline you can drop into a calendar.
Short answer: NIS2 wants an early warning within 24 hours and a notification within 72 hours; DORA wants an initial notification within 4 hours of classifying an incident as major (24 hours from awareness at the latest); the CRA wants 24-hour and 72-hour reports for actively exploited vulnerabilities and severe incidents; GDPR wants the supervisory authority notified within 72 hours of a personal data breach.
Free, runs in your browser. Nothing you enter is sent or stored. Updated: .
When did you become aware of the incident?
Your local time. The clock usually starts when you have reasonable certainty that an incident happened, not when it began.
Which regimes apply?
Tick everything that may apply. Overlapping reports are normal; prepare them from one incident record.
Leave empty to use the awareness time.
Sets the 14-day final report deadline for vulnerabilities.
Your deadlines
Who to notify
Deadlines are calculated as stated in the legal texts and implementing acts. National rules, sector guidance and the facts of the incident can change them. This is not legal advice.
Questions
Does the NIS2 72-hour clock start when the attack started?
No. NIS2 counts from when the entity becomes aware of a significant incident. Awareness means a reasonable degree of certainty that an incident with significant impact has occurred, so document when and how you reached that conclusion.
If one incident falls under NIS2 and GDPR, do I report twice?
Usually yes: NIS2 reports go to the CSIRT or competent authority (DNSC in Romania), while GDPR breach notifications go to the data protection authority (ANSPDCP in Romania). Prepare both from one incident record so the facts stay consistent.
What changed on 11 September 2026?
The Cyber Resilience Act reporting obligations started to apply. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products through ENISA's Single Reporting Platform, starting with a 24-hour early warning.
We write incident response procedures with the classification criteria and report templates already filled in, then test them with your team in a tabletop.