Significant Incident

EU NIS2 Art. 23 — reportable serious incident

26 April 2026 · Category: NIS2 · Compliance-Kit

TL;DR

Significant Incident is the EU term (NIS2 Art. 23), implemented in Germany as 'erheblicher Vorfall' (significant incident, § 32 BSIG). Thresholds: serious service impairment, material or non-material damage, impact on third parties.

What is a Significant Incident?

Significance criteria (BSI 02/2026):

Service outage >30 min
Data loss >1,000 records
Damage >EUR 100,000
Impact on third parties (customers, suppliers)

Practical example

Ransomware with a 6-hour service outage: Significant Incident. Initial report within 24 hours. Update within 72 hours including a damage assessment. Final report within 30 days.

Legal position in Germany and Austria

The term originates from the EU NIS2 Directive (Directive (EU) 2022/2555). The substantive significance threshold is the same in both countries; the competent authorities, reporting channels and legal sources differ, however.

Germany

Definition: An 'erheblicher Sicherheitsvorfall' (significant security incident) exists where it has caused or is capable of causing serious operational disruption of services or financial loss, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG).
Reporting: In three stages to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK) — an early initial report within 24 hours, a report with an initial assessment within 72 hours, and a final report within one month; where the incident is ongoing, a progress report first (§ 32(1) BSIG).
Fine: Up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities; where total turnover exceeds EUR 500 million, up to 2 % or 1.4 % respectively of worldwide annual turnover (§ 65(5) no. 1 BSIG).
Supervision: Federal Office for Information Security (BSI).

Austria

Definition: A cybersecurity incident is considered significant where it has caused or is capable of causing serious operational disruption of the services provided or serious financial loss, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 35(1) NISG 2026).
Reporting: In three stages to the competent (sector-specific or national) CSIRT — an early warning within 24 hours, a report with an initial assessment within 72 hours, and a final report within one month; where the incident is ongoing, a progress report first (§ 34(2) NISG 2026).
Administrative penalty: Up to EUR 10 million or 2 % of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4 % for important entities, whichever amount is higher (§ 45(2) and (3) NISG 2026).
Supervision: Cybersecurity Authority (Cybersicherheitsbehörde, Austria), a subordinate authority of the Federal Minister of the Interior.

Frequently asked questions

Fine for failure to report?

The fine provisions are set out in § 65 BSIG (not § 60 BSIG, which governs central EU competence for certain types of entity). Under § 65(5) no. 1 BSIG, up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities; where total turnover exceeds EUR 500 million, up to 2 % or 1.4 % respectively of worldwide annual turnover. Reputational damage comes on top.

EU coordination?

For sectoral incidents, ENISA coordinates across the EU.