Reporting obligations
Who must report what, to whom and by when – for each reporting obligation, with legal sources and an as-of date.
CRA Article 14
- Who reports
- Manufacturers of products with digital elements
- First deadline
- 24 h Early warning
- Legal basis
- Article 14 of Regulation (EU) 2024/2847, applicable since 11 September 2026
NIS2 in Germany
- Who reports
- Essential and important entities under the BSIG
- First deadline
- 24 h Early warning to the BSI
- Legal basis
- § 32 BSIG; scope § 28 BSIG; registration § 33 BSIG
GDPR breach notification
- Who reports
- Controllers under the GDPR
- First deadline
- 72 h Notification to the supervisory authority, where feasible (Article 33)
- Legal basis
- Articles 33 and 34 GDPR; § 169 TKG and Regulation (EU) No 611/2013 for telecom providers
General information, as of October 2026. Not legal advice.