Common Incident Reporting Templates under the NIS2 Directive – One Form Is Not One Door

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

GISAD welcomes the planned implementing act: uniform reporting fields for all Member States are structure – and structure is what NIS2 has lacked so far, where 27 national forms ask the same incident 27 different ways. The NIS2 Cooperation Group adopted the common templates on 26 May 2026; the implementing act will make them binding across the Union, as part of the Commission’s simplification agenda. Yet the harmonisation must not stop at the paper form.

Uniform fields are necessary, but not sufficient

Uniform fields without a uniform entry point are half a structure. A company operating in five Member States still has to serve five national portals after an incident – merely with identical forms. The Single Entry Point of the Digital Omnibus is the second, decisive step: one notification that fulfils all obligations. The implementing act should therefore be explicitly tied to the Single Entry Point, with a binding timetable.

Measure what matters, not what fills fields

The form must keep its questions measurable: affected users, outage duration, cross-border impact, origin of the incident. What does not flow into assessment does not belong in the form. A reporting form that collects data nobody evaluates breeds reporting fatigue – and reporting fatigue is a security gap.

The report is sensitive

An incident report describes the weakness of a system – often while it is still open. Whoever verifies must itself be verifiable: access to reported data must be logged, limited and bound to a purpose. Uniform fields must not turn into a central vulnerability database that itself becomes a target.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: Common incident reporting templates under the NIS2 Directive · European Commission – NIS2 Cooperation Group adopts common templates for incident reporting