Definition

Incident

An event compromising the availability, authenticity, integrity or confidentiality of data or of the services offered by network and information systems.

The CRA borrows NIS2's definition: an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems. Not every incident is reportable; only a severe incident having an impact on the security of the product triggers Article 14. Recording every incident with an explicit awareness time is nonetheless good practice, because the severity judgement is easier to defend with a complete record.

Reference: Art. 3(43), referring to Directive (EU) 2022/2555 · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-12 · Paraphrase for orientation, not legal advice.