Significant incident (NIS2)

A significant incident, under Directive (EU) 2022/2555 (NIS2), is one that triggers the reporting duties because it has caused or can cause severe operational disruption or financial loss for the entity, or considerable damage to other persons. On October 7, 2026, the French National Assembly was finally due to debate on the floor the bill on critical infrastructure resilience and stronger cybersecurity; the Conference of Presidents pulled it from the agenda the day before. The Senate had passed it on first reading on March 12, 2025, and the Assembly's special committee on September 10, 2025. In July 2026 the European Commission referred France to the Court of Justice for failing to transpose Directive (EU) 2022/2555, whose deadline ran out on October 17, 2024. As of this entry, no final vote can be found, so in France the significant incident concept has no national statute enforcing it yet. The EU definition sits in Article 23(3), where the damage to other natural or legal persons is material or non-material. The text says “capable of causing”, and that is the word that matters: an intrusion contained before any damage can qualify. For digital providers, Implementing Regulation (EU) 2024/2690 puts numbers on the thresholds. For the underwriter, the regulatory trigger and the policy trigger live apart. A cyber policy responds to a security incident, significant or not; a significant incident opens costs the policy did not always anticipate, counsel for three successive reports, exchanges with the authority, then the question of regulatory investigation cover. The reverse also happens: an outage severe in the regulator's eyes can stay inside the business interruption waiting period. And the notification file becomes evidence: an underwriter reading it at renewal sees the incident in the insured's own dated words.