NIS2 Directive · Directive (EU) 2022/2555
Article 23c
Compare the available Commission, Council and Parliament texts and amendments affecting this article.
Article total: 1 part · 1 Council draft · 0 Parliament amendments
Removed wording is struck through; added or replacement wording is highlighted.
Institutional text
European Commission proposal
All Commission’s changes to NIS2 DirectiveThe wording proposed by the Commission at the start of this legislative file.
No standalone Commission wording is mapped to these tracked parts. A newly proposed provision may have no earlier text of its own.
Institutional text
Council Presidency texts
Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.
No Council wording is mapped to this tracked part.
Article in September Presidency compromise Council text
Comparison basis: Existing law (14 December 2022) compared with September Presidency compromise (3 September 2026)
Article 23c
Harmonising incident notification framework
- 1.
By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24
- 2a.
and Article 45a
- 3a.
of Regulation (EU) 910/2014, Article 33
- 1.
of Regulation (EU) 2016/679, Article 19
- 1.
and
- 2.
of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557. The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts.
- 3.
Building on the report referred in paragraph (1), ENISA shall, in cooperation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, and other relevant bodies or groups established at Union level under relevant Union legal acts, develop guidelines for further harmonisation on incident notifications. These guidelines shall, in particular:
- (a)
Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks;
- (b)
Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency;
- (c)
Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities. ENISA shall present to the Commission and Council a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.
- (a)
Article 23c
September Presidency compromise
Council wording reconstructed for this provision from the official operation
Article 23c Harmonising incident notification framework (1) By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557. The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts. (3) Building on the report referred in paragraph (1), ENISA shall, in cooperation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, and other relevant bodies or groups established at Union level under relevant Union legal acts, develop guidelines for further harmonisation on incident notifications. These guidelines shall, in particular: (a) Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks; (b) Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency; (c) Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities. ENISA shall present to the Commission and Council a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.
Official source passage and amending instruction
1b. The following article 23c is added : ‘Article 23c Harmonising incident notification framework (1) By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557. The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts. (3) Building on the report referred in paragraph (1), ENISA shall, in cooperation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, and other relevant bodies or groups established at Union level under relevant Union legal acts, develop guidelines for further harmonisation on incident notifications. These guidelines shall, in particular: (a) Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks; (b) Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency; (c) Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities. ENISA shall present to the Commission and Council a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.
Article 23c 1 Council draft
Article 23c
3 September 2026 · September Presidency compromise
Council wording reconstructed for this provision from the official operation
Article 23c Harmonising incident notification framework (1) By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557. The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts. (3) Building on the report referred in paragraph (1), ENISA shall, in cooperation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, and other relevant bodies or groups established at Union level under relevant Union legal acts, develop guidelines for further harmonisation on incident notifications. These guidelines shall, in particular: (a) Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks; (b) Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency; (c) Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities. ENISA shall present to the Commission and Council a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.
Official source passage and amending instruction
1b. The following article 23c is added : ‘Article 23c Harmonising incident notification framework (1) By [6 months after the entry into force of this Regulation] the Commission shall submit a report to the European Parliament and to the Council outlining common elements and differences in definitions, thresholds, deadlines, formats and procedures applying to Article 23 of Directive (EU) 2022/2555, Article 19a (1a), Article 24 (2a) and Article 45a (3a) of Regulation (EU) 910/2014, Article 33 (1) of Regulation (EU) 2016/679, Article 19 (1) and (2) of Regulation (EU) 2022/2554, and Article 15(1) of Directive (EU) 2022/2557. The report shall in particular consider concrete steps and a timeline for introducing the unified approach to incident reporting under the Union legal acts. (3) Building on the report referred in paragraph (1), ENISA shall, in cooperation with the CSIRTs network, the Cooperation Group and competent authorities under the relevant Union legal acts, and other relevant bodies or groups established at Union level under relevant Union legal acts, develop guidelines for further harmonisation on incident notifications. These guidelines shall, in particular: (a) Identify ways to further harmonise templates for entities but also between CSIRTs across different sectors and legislative frameworks; (b) Provide a thorough analysis on the different sectoral thresholds, and, where appropriate, provide suggestions with regards to possible harmonization to improve efficiency; (c) Review the stages of incident notifications under different Union legal acts and recommend measures to streamline the process for entities. ENISA shall present to the Commission and Council a first draft of these guidelines [by - within 12 months after the entry into force of this Regulation], and a final version within 18 months, and shall update them regularly thereafter.
Competing proposals
European Parliament amendments
These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.
No Parliament amendment is mapped to these tracked parts.
Selected texts
Compare wording
Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.
Select a specific tracked part above to compare wording.
No same-scope comparison is available for this tracked part. Its source wording remains available in the article text sections.