The Council's Digital Omnibus Mandate Swaps One EU Reporting Portal for 27 National Ones

On 21 October 2026 the Permanent Representatives Committee agreed the Council of the EU's mandate for negotiations with the European Parliament on the Digital Omnibus, the Commission's November 2025 proposal COM(2025) 837 (procedure 2025/0360(COD)). The text was circulated to delegations the next day as Council document 14756/26. On incident reporting it makes one structural change: the single EU entry point that the European Union Agency for Cybersecurity (ENISA) was to build and operate is gone. In its place, each Member State would establish a national entry point, and ENISA would maintain an "incident reporting information point" that tells entities which obligations apply and where to file.

In May we set out what the Commission's design would demand of operators in the single entry point and the controls crosswalk. That piece assumed one ENISA filing fanned out to five sets of authorities. The Council's position changes the regulator-facing layer of that picture. "Report once" is turning into "report once per Member State". For a group with regulated entities in several countries, that is a national front door in each of them rather than one EU portal.

This is a negotiating position, not law. It is a separate file from the Digital Omnibus on AI, which became Regulation (EU) 2026/1744 and which we covered in what the AI Act deferral actually moved. The data and cyber file still needs a Parliament position and a trilogue.

Key Takeaways

• 21 October 2026: the Permanent Representatives Committee agreed the Council's negotiating mandate on the Digital Omnibus, circulated as document 14756/26 on 22 October 2026
• The Commission's ENISA-run single-entry point is deleted. A new NIS2 Article 23b would require each Member State to establish and maintain a national entry point; ENISA keeps an information point under Article 23a that, in the mandate's words, "shall not enable the submission, transmission, storage or processing of any incident notification"
• The Council kept both proposed GDPR changes: notification to the supervisory authority only for breaches likely to result in a high risk, within 96 hours where feasible. Neither is in force; Article 33 still runs on 72 hours
• Reporting via national entry points would apply 30 months after entry into force in the Council text, against 18 months (extendable to 24) in the Commission proposal
• The European Parliament has no position yet. The joint committees (ITRE and LIBE) have a draft report dated 22 June 2026 with more than 1,750 amendments tabled; a Dutch parliamentary rapporteurs' report records the committee vote as planned for February 2027
• Nothing changes in the meantime: NIS2, GDPR, DORA and, since 11 September 2026, Cyber Resilience Act Article 14 clocks apply as they stand

What the Council Mandate Changes in the Reporting Architecture

The mandate is published as a marked-up version of the Commission proposal, so the edits are visible line by line. Three of them carry the change.

Article 23a of the NIS2 Directive is repurposed. In the Commission text it created the single-entry point. In the Council text its heading becomes "Incident reporting information point". ENISA would develop and maintain it to support "the identification and fulfilment" of reporting obligations, designed to identify which obligations apply and to direct the entity to the appropriate national entry point. Paragraph 4 is explicit that it shall not enable the submission, transmission, storage or processing of any incident notification or related data, and shall not collect information identifying the notifying entity or any incident. The Commission's piloting, assessment and Official Journal notice mechanism for the portal is struck out, as is the sentence allowing ENISA to build the entry point on the Cyber Resilience Act's single reporting platform.

A new Article 23b creates national entry points. Member States "shall establish and maintain a national entry point supporting and facilitating the reporting of incidents and related events" under the Union acts that provide for it. They retain flexibility to configure it around existing national structures. A new recital describes it as a national infrastructure or arrangement through which notifications at national level reach all competent authorities and CSIRTs.

Interoperability is an aim, not a requirement. Member States "shall endeavour" to design their entry points to be interoperable with those of other Member States. ENISA would provide non-binding recommendations within 12 months of entry into force and an open-source solution that Member States may use within 18 months. A new Article 23d says Member States "should aim at facilitating cross-border notifications between national entry points" and that they retain control over the scope of information shared.

The same five regimes stay in scope: NIS2, GDPR, DORA, eIDAS and the CER Directive. The verbs soften, though. Where the Commission had financial entities, critical entities, trust service providers and data controllers notify "via the single-entry point", the Council text has them notify "with the support of the national entry point" or has notifications "supported through" it. Only the NIS2 provisions keep "via".

Report Once Becomes Report Once Per Member State

The Commission's promise was one submission, one interface, one fan-out. The Council's version keeps the promise inside a country, where the stated intent is still a single interface reaching every competent authority under the five regimes, and drops it across countries.

Across Member States, a group is back to counting jurisdictions. An incident at a shared platform that affects regulated entities established in six Member States would, on the Council text, be handled through national entry points, each configured by its Member State, rather than one EU portal. With 27 Member States, the upper bound is 27 front doors. The actual number for any group depends on where its entities are established and which authority is competent under each regime; the mandate leaves GDPR competence under Articles 55 and 56 untouched, for example. The point is that the routing question the Commission proposal would have removed stays with the operator.

Content harmonisation is also deferred rather than delivered. A new Article 23c has the Commission report within six months on the differences in definitions, thresholds, deadlines, formats and procedures across the five regimes, and has ENISA produce harmonisation guidelines, a first draft within 12 months and a final version within 18. Guidelines and non-binding recommendations are not a common template. The Parliament co-rapporteurs' draft report, by contrast, asks the Commission to create a common notification template for all EU instruments under the single-entry point, per the European Parliament's Legislative Train summary.

As we described for Sweden's Cybersecurity Act, national law already decides which authority receives the report. The Council text extends that logic to the portal itself.

What the Council Did With the GDPR Breach-Notification Changes

Two changes were in the Commission proposal, and the Council kept both.

Threshold. The amended Article 33(1) requires notification to the supervisory authority only "in the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons", aligning it with the Article 34 threshold for telling data subjects. The recital is direct: where a breach is not likely to result in a high risk, the controller should not be required to notify.

Deadline. Notification is due "without undue delay and, where feasible, not later than 96 hours" after the controller becomes aware of the breach.

The Council's additions are around the edges. The European Data Protection Board would establish and publish two lists, one of circumstances likely to result in a high risk and one of circumstances not likely to, and those lists would also apply to data-subject communication under Article 34. The recitals stress that the higher threshold does not affect the duty to document every breach under Article 33(5). And until a national entry point is established, controllers "shall continue to notify personal data breaches directly to the competent supervisory authority".

None of this is current law. Article 33 as it stands requires notification within 72 hours unless the breach is unlikely to result in a risk. Do not plan against 96 hours, and do not stop notifying sub-high-risk breaches.

What Is Still Open: Parliament, Trilogue and Timing

The Council reached this point late. A report by Dutch parliamentary rapporteurs adopted on 25 September 2026 records that no majority for a Council mandate could be found under the Cypriot presidency, and that the Irish presidency issued a new compromise text on 3 September 2026. The European Parliament's Legislative Train records the Irish presidency presenting the compromise on 19 October 2026 and the mandate being adopted on 21 October 2026.

Parliament is further behind. The file sits with the ITRE and LIBE committees jointly, with Aura Salla (EPP, Finland) and Marina Kaljurand (S&D, Estonia) as co-rapporteurs. Their draft report is dated 22 June 2026, the committees discussed it on 13 July 2026, and more than 1,750 amendments were tabled. The Legislative Train, updated 25 October 2026, gives no vote date. The Dutch rapporteurs' report states that the final vote in the two committees is planned for February 2027. Trilogues start only after Parliament has its own mandate.

Application timing moved as well. In the Council text, the amended reporting provisions apply 18 months after entry into force, and the obligations to report via the national entry point apply 30 months after entry into force. The Commission proposed 18 months, extendable to 24 if its assessment found the portal wanting; the Council deleted that mechanism and wrote in a flat 30. With no adoption date, each is a count from an unknown start.

What Does Not Change in the Meantime

The clocks in force are the clocks to meet:

The Cyber Resilience Act row is the newest. As we covered in CRA Article 14 reporting going live, manufacturers have been required to submit these notifications through ENISA's Single Reporting Platform since 11 September 2026. The Council mandate keeps that channel separate from the national entry points, while retaining the Commission's bridge that a manufacturer's severe-incident report under CRA Article 14(3) can count as the NIS2 report where it contains the required information.

Building a Crosswalk That Survives Either Outcome

The May crosswalk separated what an organization knows about an incident from which regime needs it. The Council mandate adds a second separation: content from channel. Three design choices hold whether trilogue lands on one EU portal, 27 national ones, or something between.

One canonical incident record, many regime views. Detection timestamp, awareness timestamp, affected services, affected data subjects, classification decisions and remediation steps live in one record. Each regime's notification is a view computed from it.

A routing table as its own artifact. One row per legal entity, per Member State, per regime, naming the competent authority, the current channel, the named filer and the backup. A national entry point or an EU portal is a change to that column, not to the record. The same table is where cross-framework vendor exposure becomes operational: one supplier incident, read across every entity it touches.

Classify personal data breaches against both thresholds. Record whether the breach is likely to result in a risk (the test in force) and whether it is likely to result in a high risk (the proposed test). The first drives the 72-hour notification that applies now. The second is already the Article 34 test, and it is the one the Commission and the Council now agree on. Documenting every breach remains mandatory in both worlds.

What This Changes for the Executive Team and the Deal Team

Stop budgeting against a single EU filing. Any business case that assumed the Digital Omnibus would collapse multi-country reporting into one submission should be re-run on the Council scenario. The saving inside each country may still arrive. The cross-border saving is now a trilogue outcome, not a planning assumption.

Treat the timetable as long. A committee vote planned for February 2027, then trilogue, then 30 months in the Council text. Programmes that paused incident-reporting work to wait for the portal are waiting for something several years away.

For acquirers of multi-country targets, ask for the routing table. A target operating in several Member States either knows, per entity and per regime, where it files and who files, or it does not. That is a short diligence request with a revealing answer.

Innovaiden's Incident Reporting Routing Review produces the two artifacts described here: the canonical incident record mapped to every regime in force, and the routing table by legal entity, Member State and regime, with the entry-point column left deliberately replaceable. It is built on the clocks in force, so it pays for itself before the Digital Omnibus is adopted and needs one column edited afterwards, whichever architecture survives.