Article 23 – Reporting obligations

Source: ST 12535/26, page 144 Omnibus Article 6, point 2 · pp. 144–145

Changes since18 June 2026ST 10677/26, Art 23

Same wording as in the Council text of 18 June 2026. Every text of this provision

Text as printed

Same wording since 10 June · Changes since the Commission proposal

Article 23(1), first sentence In every text (Article 23(1), first sentence)

2. Article 23 is amended as follows:

Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of this Article of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 of this Article (significant incident) via the national entry point pursuant to Article 23b.

Article 23(12) In every text (Article 23(12))

2. Article 23 is amended as follows:

(12)

When a manufacturer notifies a severe incident pursuant to Article 14(3) of Regulation (EU) 2024/2847 and the incident reporting under that Article contains relevant information as required under paragraph 4 of this Article, the reporting of the manufacturer under Article 14(3) of Regulation (EU) 2024/2847 shall constitute reporting of information under paragraph 4 of this Article.

Article 23(1b) In every text (Article 23(1b))

(b)

ENISA shall, in cooperation with the Cooperation Group, provide a mapping of all the competent authorities and CSIRTs referred to in paragraph 1 in the incident reporting information point established pursuant to Article 23a.