When Are Your Reports Due?
Enter the time your organisation became aware of the incident and the time it was classified as major. The calculator applies Art. 19(4) and RTS 2024/1772: the initial notification is due 4 hours after classification and never later than 24 hours after detection; the intermediate report follows 72 hours after the initial notification; the final report one calendar month after that. Times are entered and shown in your local time zone.
How the Deadlines Work
Initial notification: two clocks, the stricter wins. Art. 19(4)(a) requires the initial notification no later than 4 hours after the incident has been classified as major, and in any case no later than 24 hours after the entity became aware of the incident. A classification that arrives late does not buy back time the detection clock has already spent — this calculator always applies the earlier of the two.
Intermediate report: 72 hours. The intermediate report is due 72 hours after the initial notification, even where there is no change in status, and again without undue delay when regular activities have been recovered.
Final report: one calendar month. The final report is due one month after the intermediate report. The deadline follows the calendar, not a fixed 30 days: a report due from the 31st lands on the last day of a shorter month.
Only major incidents. The mandatory deadlines apply to incidents classified as major under CDR 2024/1772. Non-major incidents are recorded internally; significant cyber threats may be reported voluntarily.
Frequently Asked Questions
The 4-hour clock starts when the incident is classified as major under the CDR 2024/1772 criteria — not when the incident occurs. But the classification itself must happen without undue delay, and the initial notification is never due later than 24 hours after the entity became aware of the incident. Whichever clock runs out first governs.
The initial notification is a short alert: what happened, when it was detected and classified, which services and members states are affected, and a first indication of severity. The detailed impact assessment belongs in the intermediate report 72 hours later. Do not wait for complete information before sending the initial notification.
No. The 4-hour, 24-hour and 72-hour deadlines run in calendar time, including nights, weekends and public holidays. This is why entities need an on-call arrangement for incident classification and reporting.
No — it is one calendar month after the intermediate report. A deadline that would fall on the 31st of a shorter month moves to the last day of that month. The calculator applies this rule automatically.