Reporting cyber security incidents starts with understanding what happened

When a cyber incident occurs, an organisation usually has more pressing concerns than reporting deadlines. The immediate priority is to understand what is happening, contain the damage and restore business operations. Yet pressure builds quickly from lawyers, regulators, customers and external advisers: do we need to report this, to whom, and by when?

That question is understandable, but under the new EU data and cyber laws it is too narrow. In recent years, the European regulatory framework for incident response has expanded considerably. Alongside the General Data Protection Regulation (“GDPR”), organisations must now consider the Network and Information Security 2 Directive (Directive (EU) 2022/2555; “NIS2”), the Digital Operational Resilience Act (Regulation (EU) 2022/2554; “DORA”), the Artificial Intelligence Act (Regulation (EU) 2024/1689; “AI Act”) and the Cyber Resilience Act (Regulation (EU) 2024/2847; “CRA”). Each regime has its own definition of a reportable incident, its own reporting deadline, its own regulator and its own set of addressees. The simple “72-hour question” assumes it is already clear which regime applies. In the first hours of an incident, that is rarely the case.