ACN implementation guidance for first application sets the 9-month incident-notification milestone in January 2026. that deadline is past and the incident-notification obligation is live. Organizations should now focus on execution reliability for 24h/72h reporting and sustained governance oversight.
Key takeaways
- ACN’s first-application timeline places the 9-month notification milestone in January 2026.
- incident-notification obligations are already in force.
- Notification workflow must support pre-notification (24h), notification (72h), and follow-up reporting obligations.
- Legal timing depends on incident evidence acquisition, not on root-cause completion.
- Role governance, procedures, and evidence traceability are required for stable live operations.
Post-deadline operating model (live obligation)
Phase 1 (Immediate): governance and role confirmation
Confirm Point of Contact / CSIRT interface responsibilities, escalation ownership, and duty coverage.
Phase 2 (Days 15-45): process hardening and evidence quality
Harden notification workflow, evidence-timestamp capture, and reporting templates for mandatory submission steps.
Phase 3 (Days 46-75): simulation and defect fixing
Run simulations for 24h/72h obligations, identify bottlenecks, and fix process/control defects.
Phase 4 (Ongoing): live-readiness assurance
Run monthly validation on role availability, contact channels, submission quality, and management oversight records.
Control points for live-notification reliability
| Control | Objective | Evidence |
|---|---|---|
| Trigger clarity | Start timing from evidence acquisition | Incident evidence log |
| Role coverage | Ensure always-available submission ownership | Duty matrix and substitutes |
| Procedure quality | Enforce 24h/72h and follow-up sequence | Notification SOP and checklists |
| Simulation maturity | Test deadline execution under stress | Drill reports and remediation log |
Conclusion and next steps
Since the first-application 9-month deadline is already past, the priority is now live-operability discipline. The fastest path to confidence is to combine role governance, simulation cycles, and documented corrective actions with continuous 24h/72h performance tracking.
FAQ
Is the 9-month notification milestone still upcoming?
No. ACN first-application timeline places it in January 2026; the obligation is already live.
Can investigation be completed before first notification?
Not required. Initial submissions are time-bound and can be updated as investigation progresses.
What if key data is missing at 24h?
Details are defined in the official call documentation and incident-notification guidance.
Related reading
- NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations
- NIS2 Article 25 in Practice: Incident Notification Obligations and Operating Timeline
- NIS2 incident management and CSIRT notification plan: practical guide for an approvable RS.MA-01 document
- Aegister NIS2 Compliance Service
