Since 2016, no incident anywhere in the EU has been classified as large-scale - not WannaCry, not NotPetya, not the CrowdStrike outage. The reason is not that nothing large happened. It is that classification is a decision somebody has to make.

NIS2 gives you 24 hours for an early warning, 72 for a notification and a month for the final report - all counted from when you notice. That makes detection, not legal readiness, the binding constraint.