Features
Incident management
Record incidents, check the reporting obligation under NIS2, the CRA and Art. 33 GDPR with guidance and keep track of every deadline.
In a security incident, the reporting deadlines run from the time of awareness, and whether to report has to be decided quickly and with justification.
How Complass helps
The relevant report types
Significant security incident under § 32 BSIG, actively exploited vulnerability and severe security incident under Art. 14 CRA, plus personal data breaches under Art. 33 GDPR and internal incidents. You are offered what matches your modules.
Guided check of the reporting obligation
Questions based on the legal text lead to the decision “reportable or not”, with a mandatory justification for the record.
Deadlines with countdown
Reporting stages with calculated deadline: under NIS2 early warning within 24 hours, notification within 72 hours, final report after one month; under the CRA early warning, notification and final report.
Prepare and document the report
Record and copy the content per stage, enter submission and reference number. You submit the report itself in the authority’s reporting portal.
Everything on the incident
Affected assets, comments, evidence files, timeline and PDF report. Running deadlines appear on the dashboard.
Legal basis
- § 32 BSIG§ 32 BSIG Meldepflichten(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, folgende Informationen an eine vom Bundesamt und dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe eingerichtete gemeinsame Meldestelle zu melden: - 1. unverzüglich, spätestens jedoch innerhalb von 24 Stunden nach Kenntniserlangung von einem erheblichen Sicherheitsvorfall, eine frühe Erstmeldung, in der angegeben wird, ob der …Open original (gesetze-im-internet.de) ↗
- Art. 23 NIS2-RichtlinieArticle 23 NIS 2 Directive Reporting obligations1. Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (significant incident). Where appropriate, entities concerned shall notify, without undue delay, the recipients of their …Open original (EUR-Lex) ↗
- Art. 14 CRAArticle 14 Cyber Resilience Act Reporting obligations of manufacturers1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16. 2. For the purposes of …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Art. 33 DSGVOArticle 33 GDPR Notification of a personal data breach to the supervisory authority1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
- Art. 34 DSGVOArticle 34 GDPR Communication of a personal data breach to the data subject1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
Calculate CRA reporting deadlines free of charge, no sign-up
This page describes Complass features and is not legal advice.
Alerting by SMS and voice
For a reportable incident Complass also alerts your incident team by text message and voice call, even at night, asks for an acknowledgement and escalates to the deputy. Who was reached when is recorded as evidence. Add-on.
Create an incident, keep deadlines in view
The short film shows the German user interface.
Frequently asked questions
Does Complass submit the report to the authority?
No. Complass calculates the deadlines and prepares the content. You submit the report in the reporting portal and enter the time and reference number in the incident.
Who is incident management available for?
The statutory report types are available with the NIS2, CRA or GDPR modules. You can record data breaches under Art. 33 GDPR with the 72-hour deadline with the GDPR module alone. You can record internal incidents in any case.
Does the check replace a legal assessment?
No. The questions help you make the decision in a structured and justified way; responsibility for the assessment remains with you.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.