What it asks for. Article 23 requires essential and important entities to notify their CSIRT or competent authority of significant incidents without undue delay. It sets staged reporting: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month, plus informing service recipients where appropriate.
In practice. The entity has criteria for judging when an incident is significant, a named owner for regulatory reporting, templates for each stage and contact details for the relevant authority in every Member State where it operates. The clock starts at awareness, so detection and escalation must be fast. Evidence includes the reporting procedure, decision records and submitted reports.
Common gaps. Organisations often lack agreed criteria for significance and lose time debating it. Groups operating in several countries may not know which authority to notify.