# Reporting obligations 23(11) — NIS2 — provision context

> Focused context for a single provision (23(11)), curated from overview.legal on 2026-10-06. Canonical: https://overview.legal/laws/nis2/art-23#par-11
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Reporting obligations** (NIS2, full article: https://overview.legal/laws/nis2/art-23).

## Provision text

### 23(11)

The Commission may adopt implementing acts further specifying the type of information, the format and the procedure of a notification submitted pursuant to paragraph 1 of this Article and to Article 30 and of a communication submitted pursuant to paragraph 2 of this Article.

- By 17 October 2024, the Commission shall, with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines and of social networking services platforms, adopt implementing acts further specifying the cases in which an incident shall be considered to be significant as referred to in paragraph 3. The Commission may adopt such implementing acts with regard to other essential and important entities.
- The Commission shall exchange advice and cooperate with the Cooperation Group on the draft implementing acts referred to in the first and second subparagraphs of this paragraph in accordance with Article 14(4), point (e).
- Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 39(2).

## Cited by (exact-provision citations)

- **EDPB-EDPS Joint Opinion 4/2026 on the Proposal for a Cybersecurity Act 2 and the Proposal on amendments to the NIS 2 Directive** (guidance) — https://overview.legal/posts/592961

---
Generated by overview.legal · https://overview.legal/laws/nis2/art-23#par-11 · 2026-10-06