Under NIS2 Article 23(3), an incident is significant if it has caused or can cause severe operational disruption or financial loss for the entity, or if it has affected or can affect other people by causing considerable material or non-material damage. For some digital provider types, a Commission regulation adds specific thresholds.
The general test
The directive gives two limbs, and meeting either is enough:
- Severe operational disruption of services, or financial loss, for the entity concerned.
- Considerable material or non-material damage to other natural or legal persons.
Note the wording "has caused or is capable of causing". An incident that has not yet done damage can still qualify if it could. That pushes teams to classify early, on potential, not only on confirmed impact.
The extra thresholds for certain provider types
Commission Implementing Regulation (EU) 2024/2690 applies to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. Article 3 treats an incident as significant for them where one or more of these hold:
- Direct financial loss that exceeds EUR 500 000 or 5 % of annual turnover in the preceding financial year, whichever is lower.
- Exfiltration of trade secrets.
- Death of a person, or considerable damage to a person's health.
- Successful, suspectedly malicious and unauthorised access that could cause severe operational disruption.
- Criteria set out in the later articles of that regulation, which cover things like service unavailability and user impact.
Scheduled interruptions and planned effects of scheduled maintenance are excluded.
Turn it into a decision aid
A short triage sheet helps the person on call. Ask:
- Is any service down or degraded in a way that customers will notice?
- Is there any sign of unauthorised access to production systems?
- Is customer or partner data affected?
- Could the incident harm anyone outside the company?
- What is the best estimate of direct cost so far?
If the answer to any is "yes" or "unknown and plausible", escalate to the person who decides on significance. Write down the time the decision was made and the reasoning. Reclassification later is normal, and the record shows you acted in good faith.
Overreporting versus underreporting
Neither the directive nor the implementing regulation tells you to guess low. Authorities can ask for evidence of how you assessed an incident. A written rule applied consistently is easier to defend than ad hoc judgement. Check whether your national authority has published its own guidance, since national law can add detail.
Safeguard can feed your triage with dependency and vulnerability data, for example showing which services are exposed to a newly disclosed flaw, but the significance call is a legal and business judgement.
Quick check
Do all NIS2 entities use the EUR 500 000 threshold?
No. That threshold is in Implementing Regulation 2024/2690, which covers specific digital entity types. Other entities use the general test in Article 23(3) plus national guidance.
Can an incident be significant before damage occurs?
Yes. The text says "capable of causing", so potential impact counts.
Sources
Last reviewed: 19 October 2026.
