Article 30Voluntary notification of relevant information
1. Member States shall ensure that, in addition to the notification obligation provided for in Article 23, notifications can be submitted to the CSIRTs or, where applicable, the competent authorities, on a voluntary basis, by:
(a) essential and important entities with regard to incidents, cyber threats and near misses;
(b) entities other than those referred to in point (a), regardless of whether they fall within the scope of this Directive, with regard to significant incidents, cyber threats and near misses.
2. Member States shall process the notifications referred to in paragraph 1 of this Article in accordance with the procedure laid down in Article 23. Member States may prioritise the processing of mandatory notifications over voluntary notifications.
Where necessary, the CSIRTs and, where applicable, the competent authorities shall provide the single points of contact with the information about notifications received pursuant to this Article, while ensuring the confidentiality and appropriate protection of the information provided by the notifying entity. Without prejudice to the prevention, investigation, detection and prosecution of criminal offences, voluntary reporting shall not result in the imposition of any additional obligations upon the notifying entity to which it would not have been subject had it not submitted the notification.
NIS2, the European Union directive on network and information security, Article 30
Member States must ensure that, in addition to the mandatory notifications under Article 23, notifications can be submitted voluntarily to CSIRTs or, where applicable, competent authorities. Essential and important entities may report incidents, cyber threats and near misses. Other entities, whether or not they fall within the Directive’s scope, may report significant incidents, cyber threats and near misses.
Member States process voluntary notifications under the Article 23 procedure, and may prioritise mandatory ones. Where necessary, CSIRTs and competent authorities pass information about them to the single points of contact, keeping the notifying entity’s information confidential and protected.
The safeguard is in the last sentence: without prejudice to the prevention, investigation, detection and prosecution of criminal offences, voluntary reporting must not lead to additional obligations on the notifying entity that would not have applied had it not reported. That limits obligations arising from the act of reporting. It does not say what follows from the facts reported, so it is not a general protection from supervisory or other action on those facts.
What is in the packs for this
Regulatory Notification Operating ProcedureWord
Helps with this requirementin Regulatory Incident Notification & Reporting
The procedure's scope says that a voluntary notification follows the same steps as a required one.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.