Executive regulatory tooling

EU Cyber Incident

Executive regulatory blast-radius and SLA engine — classify an incident against DORA, NIS2, GDPR, the EU AI Act and the Cyber Resilience Act, and inspect the exact EU legal basis for every result. This tool is a preliminary discovery aid and educational simulation — it does not provide legal, regulatory or professional advice. Read the full Legal Disclaimer & Terms of Use before acting on any output.

Entity & timing
Impact metrics
DORA conditions
NIS2 conditions
GDPR conditions
EU AI Act conditions
CRA / product conditions

Triggered regimes

Decision — Layer 1 of 3 · what applies to this incident

Mandatory actions & deadlines

Action — Layer 2 of 3 · soonest first · live countdowns

What you need to do now

Executive & board playbook

Evidence: legal citations & EUR-Lex references

Every classification, deadline and board action cites the exact EU provision it derives from. Expand any entry to read the official legal text and open the EUR-Lex source. This tool is for incident-response simulation and is not legal advice.

Major ICT-related Incident Classification Thresholds

DORA RTS 2024/1772 · Article 1, para. 1, Point (a)

An ICT-related incident shall be classified as major where it has affected critical or important functions and meets at least two of the criteria referred to in Article 1(2) or if it meets the criterion referred to in Article 1(2), point (a).

Mandatory Condition: Must impact Critical or Important Functions (CIF) and meet at least 2 RTS quantitative criteria or critical client threshold.

Operational Cyber Incident Outage

DORA RTS 2024/1772 · Article 1, para. 1, Point (c)

An ICT-related incident shall be classified as major where it is a cyber attack or operational breakdown that has caused complete unavailability of critical infrastructure or core services.

Complete unavailability of a critical service affecting CIF constitutes an automatic Major ICT Incident.

Initial Notification Deadline

DORA · Article 19, para. 4, Point (a)

Submit an initial notification without delay, and in any event no later than 4 hours from the classification of the incident, but no later than 24 hours from becoming aware of the incident.

Initial notification capped at max 4h post-classification and 24h absolute post-awareness.

Significant Incident Definition

NIS2 · Article 23, para. 3

An incident shall be considered significant if: (a) it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned; (b) it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

Triggered by severe operational disruption, financial loss, or material/non-material damage to third parties.

Governance & Director Personal Liability

NIS2 · Article 20, para. 1

Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures... and can be held personally liable for non-compliance by the entity.

Explicit Board and C-suite personal liability exposure for failing to oversee or implement cybersecurity risk measures.

Notification of Personal Data Breach to Supervisory Authority

GDPR · Article 33, para. 1

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority.

Mandatory notification to DPA within 72 hours of becoming aware.

Communication of Personal Data Breach to Data Subject

GDPR · Article 34, para. 1

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

Mandatory direct communication to data subjects without undue delay when high risk to natural persons is present.

Reporting of Serious Incidents Involving High-Risk AI

EU AI Act · Article 73, para. 1

Providers of high-risk AI systems deployed in the Union market shall report any serious incident to the market surveillance authorities... immediately after establishing a causal link and no later than 15 days after becoming aware of it.

Mandatory maximum 15-day reporting to market surveillance authorities for serious incidents stemming from high-risk AI.

Reporting of Actively Exploited Vulnerabilities

CRA · Article 14, para. 1

A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator... and to ENISA via the single reporting platform established pursuant to Article 16.

Actively exploited product vulnerabilities must be notified via ENISA Single Reporting Platform within 24h early warning, 72h full notification, and 14 days post-mitigation.

Reporting of Severe Incidents in Digital Products

CRA · Article 14, para. 3

A manufacturer shall notify any severe incident having an impact on the security of the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator... and to ENISA via the single reporting platform established pursuant to Article 16.

Severe incidents affecting product security require early warning within 24h, 72h notification, and 1-month final report via ENISA SRP.

ENISA Single Reporting Platform (SRP)

ENISA SRP · Article 16, para. 1

ENISA shall establish a single reporting platform for the submission of notifications pursuant to Article 14... Submission via the platform shall simultaneously route the report to the coordinating national CSIRT and ENISA.

Single-entry submission mechanism hosted by ENISA fulfilling dual simultaneous notification to national CSIRTs and EU level.

Early warning deadline

NIS2 · Article 23, para. 4, Point (a)

An early warning shall be submitted without undue delay and in any event within 24 hours of becoming aware of the significant incident.

Mandatory early warning to national CSIRT/competent authority within 24 hours of becoming aware of a significant incident.

Incident notification deadline

NIS2 · Article 23, para. 4, Point (b)

An incident notification shall be submitted without undue delay and in any event within 72 hours of becoming aware of the significant incident.

Mandatory incident notification within 72 hours of becoming aware of a significant incident.

Final report deadline

NIS2 · Article 23, para. 4, Point (e)

A final report shall be submitted no later than one month after the submission of the incident notification under point (b).

Final report due no later than one month after the incident notification under point (b).

Intermediate report

DORA · Article 19, para. 4, Point (b)

Submit an intermediate report as soon as the status of the original incident has changed significantly or upon request.

Intermediate report due when the incident status changes significantly or upon request by the competent authority.

Final report

DORA · Article 19, para. 4, Point (c)

Submit a final report no later than one month after the operational resolution of the incident.

Final report due no later than one month after operational resolution of the incident.

Legal disclaimer & terms of use

IMPORTANT — READ CAREFULLY BEFORE USING THIS TOOL

1. Preliminary Discovery & Informational Purpose Only

The EUCyber application (including all associated algorithms, decision trees, countdown timers, SLA metrics, regulatory classifications, and output playbooks, hereinafter referred to as the “App”) is provided solely as an informal, preliminary discovery tool for general informational and educational guidance. The App is intended exclusively to assist users in initiating their initial, high-level exploration of potential obligations under European cyber regulations (including DORA, NIS2, GDPR, EU AI Act, and CRA).

2. No Legal, Regulatory, or Professional Advice

The App does not constitute legal, regulatory, compliance, risk management, or operational advice, nor does it establish an attorney-client or advisory relationship of any kind. Cybersecurity regulatory reporting requirements, incident classification thresholds, and legal deadlines are highly fact-specific, dynamic, and subject to evolving statutory interpretations and national implementations across EU Member States. The App must not be relied upon, used, or substituted for formal legal counsel, qualified cybersecurity advice, or official consultation with competent national authorities.

3. Assumption of Risk & Absolute Non-Reliance

By accessing or using the App, you explicitly acknowledge and agree that:

  • You use the App and any generated outputs entirely at your own risk.
  • You will not rely on the App or its outputs to make, defer, or omit any corporate, operational, financial, legal, or regulatory decisions — including but not limited to formal incident notifications, regulatory filings, board reporting, or system containment actions.
  • You are solely responsible for independently verifying all statutory deadlines, legal definitions, and regulatory obligations with qualified legal counsel and official regulatory texts prior to taking or omitting any action.

4. Absolute Exclusion of Warranties

The App is provided on an “AS IS” and “AS AVAILABLE” basis, without warranties or representations of any kind, whether express, implied, statutory, or otherwise. The developer, owner, and contributors (collectively, “Provider”) expressly disclaim all warranties, including but not limited to:

  • Implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
  • Any warranty regarding the accuracy, completeness, timeliness, currency, reliability, or legal correctness of any output, formula, threshold calculation, statutory citation, or SLA countdown sequence.
  • Any guarantee that the App reflects current national transposition laws, delegated acts, regulatory technical standards (RTS), or administrative guidance.

5. Total Limitation of Liability & Hold Harmless

To the maximum extent permitted by applicable law, in no event shall the Provider, its affiliates, or its agents be liable to you, your organization, or any third party for any direct, indirect, incidental, consequential, special, punitive, or exemplary damages, or any losses whatsoever — including but not limited to regulatory fines, administrative sanctions, legal costs, operational downtime, business interruption, loss of data, loss of revenue, or damage to reputation — arising out of or in connection with:

  • Your use of, access to, or inability to use the App;
  • Any decision made, action taken, or action omitted by you or your organization in reliance upon the App or its outputs;
  • Any error, inaccuracy, omission, or delay in the App’s calculations, statutory citations, or regulatory SLA timelines.

You agree to fully defend, indemnify, and hold harmless the Provider against any and all claims, liabilities, losses, demands, damages, and expenses (including legal fees) arising from or related to your or your organization’s use of the App or reliance upon its outputs.

6. Mandatory Independent Legal Verification

Notice to Corporate Officers, C-Suite, and Board Members: Proper compliance with European cybersecurity legislation requires tailored analysis by certified legal and technical experts. Using this App does not satisfy, fulfill, or mitigate any legal or statutory compliance obligations under applicable Union or national law.