EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

NIS2· Article 23

Text

Article 23 NIS2 as printed in the Council text of 22 October 2026

Reporting obligations

Source Council, 22 October 2026. Article 23: ST 14756/26, page 165 · pp. 165–166 · exact text page

Scope This text prints Article 23(1), first sentence, Article 23(12), Article 23(1b) only.

Article 23(1), first sentence

Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) via the national entry point pursuant to Article 23b.

Article 23(12)

(12)

When a manufacturer notifies a severe incident pursuant to Article 14(3) of Regulation (EU) 2024/2847 and the incident reporting under that Article contains relevant information as required under paragraph 4 of this Article, the reporting of the manufacturer under Article 14(3) of Regulation (EU) 2024/2847 shall constitute reporting of information under paragraph 4 of this Article.

Article 23(1b)

(b)

ENISA shall, in cooperation with the Cooperation Group, provide a mapping of all the competent authorities and CSIRTs referred to in paragraph 1 in the incident reporting information point established pursuant to Article 23a.

Article 23 in the whole NIS2 Directive

How each paragraph has changed

Show the statuses
What each text would do to the law in force
Paragraph Commission19 Nov 2025Council21 May 2026Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
1Paragraph 1first sentence Amends Changed Amends , changed since the proposal Changed Amends Unchanged Amends Unchanged Amends Unchanged Amends Unchanged Amends Unchanged 6
1bParagraph 1b Not in the law in force or this text In neither text Adds , added since the proposal Added Adds , changed since 21 May Changed Adds Unchanged Adds Unchanged Adds Unchanged Adds Unchanged 0
12Paragraph 12 Adds Added Adds Unchanged Adds Unchanged Adds Unchanged Adds Unchanged Adds Unchanged Adds Unchanged 0
Provisions only Parliament would add or change1 unit Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text 1

Each text against the law in force: +Adds adds a provision the law in force lacks~Amends amends the law in force— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed=Unchanged same as the text before— in neither text

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 Amends Adds paragraph 12 and amends paragraph 1. Article 23 in this text
  2. 21 May 2026 Council textST 9547/26 Changed Adds paragraph 1b and changes paragraph 1.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 23 in this text
  3. 10 Jun 2026 Council textST 10426/26 Changed Changes paragraph 1b. Article 23 in this text
  4. 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 23 in this text
  5. 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 3 amendments to this article. Amendments in this document
  6. 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 2 amendments to this article. Amendments in this document
  7. 27 Jul 2026 ITRE–LIBE amendments 1741–1840 to the draft reportCJ72-AM-791883 2 amendments to this article. Amendments in this document
  8. 3 Sep 2026 Council textST 12535/26 Unchanged Same as the text before. Article 23 in this text
  9. 2 Oct 2026 Council textST 13886/26 Unchanged Same as the text before. Article 23 in this text
  10. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 23 in this text

Paragraph 1

Changed by the Commission · changed by the Council on 21 May

Parliament amendments 6

6 propose alternative wording.

By political group; co-sponsored amendments count for each group
TypeS&DEPPECRPfEESN
~ Alternative11131

By political group

  • ~ Alternative S&D 1 EPP 1 ECR 1 PfE 3 ESN 1
  1. 280 Alternative Victor NegrescuS&D · JURI “Member States shall ensure that guidance and support on incident reporting, including standard templates and explanatory material, are made easily…”

    Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) via the single-entry point established pursuant to Article 23a. Member States shall ensure that guidance and support on incident reporting, including standard templates and explanatory material, are made easily accessible, in particular for SMEs that qualify as important entities, to strengthen their cybersecurity posture and facilitate compliance.

    Tabled by
    Victor Negrescu
    Group
    S&D
    Targets
    NIS2 Directive Article 23(1), first sentence
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 6 – paragraph 1 – point 2 – point a / Regulation (EU) 2023/2854 / Article 23
  2. 281 Alternative Daniel BudaEPP · JURI “through a national interface or, where the competent Member State has so decided, through the interoperable European framework”

    ‘Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) via the single-entryreporting channel designated by the competent Member State, including through a national contact point, through a national interface or, where the competent Member State has so decided, through the interoperable European framework established pursuant to Article 23a.’

    Tabled by
    Daniel Buda
    Group
    EPP
    Targets
    NIS2 Directive Article 23
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 6 – paragraph 1 – point 2 – point a / Directive (EU) 2022/2555 / Article 23 – paragraph 1 – point a
  3. 282 Alternative Ton Diepeveen +1PfE · JURI “Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent…”

    Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) via the single-entry point established pursuant to Article 23a.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Targets
    NIS2 Directive Article 23(1), first sentence
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 6 – paragraph 1 – point 2 – point a / Directive 2002/58/EC / Article 23 – paragraph 1
  4. 515 Alternative Virginie JoronPfE · IMCO “Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent…”

    Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) via the single-entrynational pointsingle points of entry established pursuant to Article 23a.;

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    NIS2 Directive Article 23(1), first sentence
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 6 – paragraph 1 – point 2 – point a / Directive (EU) 2022/2555 / Article 23 – paragraph 1
  5. 1806 Alternative Markus BuchheitESN · ITRE–LIBE “Member States may provide for national digital reporting channels for that purpose. Notification through tools”

    Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that hashaving a significant impact on the provision of their services. asMember States may provide for national digital reporting channels for that purpose. Notification through tools referred to in paragraphArticle 323a may be required only in cases of thiscross-border Articleor (significantUnion-wide incident)systemic via the single-entry point established pursuant to Article 23arelevance.

    Tabled by
    Markus Buchheit
    Group
    ESN
    Targets
    NIS2 Directive Article 23(1), first sentence
    Document
    ITRE–LIBE amendments 1741–1840 to the draft report
    Printed header
    Article 6 – paragraph 1 – point 2 – point a / Directive (EU) 2022/2555 / Article 23 – paragraph 1
  6. 1807 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Each Member State shall ensure that their national single-entry points notify, without undue delay, its CSIRT or, where applicable, its competent…”

    Each Member State shall ensure that essentialtheir andnational importantsingle-entry entitiespoints notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) viato the EU single-entry point established pursuant to Article 23a.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    NIS2 Directive Article 23(1), first sentence
    Document
    ITRE–LIBE amendments 1741–1840 to the draft report
    Printed header
    Article 6 – paragraph 1 – point 2 – point a / Directive (EU) 2022/2555 / Article 23 – paragraph 1

Paragraph 1b

Added by the Council on 21 May · changed on 10 June

Paragraph 12

Added by the Commission

Provisions only Parliament amendments would add or change

1 amendment on 1 unit the Commission proposal leaves unchanged

Point (3ba) (new)New

  1. 512 Addition Sophia KircherEPP · IMCO “The Commission should, by means of implementing acts, develop a common notification template for the single-entry point covering core elements…” numbered 3b

    (3b)The Commission should, by means of implementing acts, develop a common notification template for the single-entry point covering core elements re-quired under Union legal acts that provide for notification through this single-entry point. It shall enable entities to submit a single notification to fulfil multiple reporting obligations. In preparing the draft implementing acts, the Commission shall cooperate with ENISA, the Cooperation Group, the CSIRTs Network and, where relevant, other competent authorities responsible for the Union legal acts concerned.

    Tabled by
    Sophia Kircher
    Group
    EPP
    Targets
    NIS2 Directive Article 23 – paragraph 1 – point 3b a (new)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 6 – paragraph 1 – point 1 / Directive (EU) 2022/2555 / Article 23 – paragraph 1 – point 3b a (new)