Incident command: from the facts of an incident to the notices that are due
About this documentUpdated 2026-09-21ShowHide
Sean McDermott, Co-Founder and CEO, UnGovr
Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.
Every law named here links to its summary page on lexlint.org, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.
© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same licence. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.
Corpus figures as of 2026-09-21.
Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice at the foot says what that means.
The clocks document lists every reporting deadline an incident can start. Which of them your incident actually starts turns on a small set of facts: what kind of event it was, where the affected people live, and when you became aware. This document is the method: the facts, the three states a clock can be in, how to read the conditions inside a clock sentence, and what to record so the answer can be defended later.
1What this document is
The clocks an incident starts draws every reporting clock in the corpus on one axis and prints the sentence each was read from. It answers "which clocks exist". The question an incident asks is narrower and harder: which of them does this event start, for this OPERATOR, in these places, from which moment. A project that declares the European Union and reads the clocks by place alone sees the security, breach and AI clocks together whatever actually happened, because place is not what tells them apart. The nature of the event is.
This document is the method for that second question. It names the facts that decide it, says how far each clock family reaches by place, gives a clock three possible states and forbids a fourth, and shows how to read the conditions inside a clock sentence. It ends with what to record, because the answer is going to be asked about later, under a deadline, by someone who was not there. It is written so that a person can apply it by hand against the clocks document and a project's own declaration, and so that a tool applying the same rules gives the same answer.
Report what the sentences say and which confirmed facts meet them. Never conclude that no notice is owed. A clock that a fact sets aside stays on the page with the fact beside it. A clock behind a judgment standard runs unless counsel decides otherwise. A clock with no number still runs. The words "does not apply" and "not required" are never written, by a person or a tool.
2Four kinds of event, four families of clock
The corpus already splits its reporting clocks by the kind of event that starts them, and the split is the first thing the facts decide. Each family is engaged by one question about the incident, and a family the facts do not engage is set aside as a whole, with the answer that set it aside. The counts are the corpus's on 2026-09-21.
| Family | Engaged when | Instruments | Jurisdictions | Numeric clock | Standard only |
|---|---|---|---|---|---|
| Security law: incident and vulnerability reporting | The security of your systems, your service or a product you ship was compromised. | 79 | 66 | 55 | 20 |
| Privacy law: personal-data breach notification | Personal data was involved: the event exposed, altered, lost or gave access to information about people. | 180 | 172 | 109 | 58 |
| AI law, high-risk systems: serious-incident reporting | An AI system the law classes as high-risk caused or contributed to the event. | 35 | 29 | 1 | 2 |
| AI law, frontier models: safety-incident reporting | A frontier or general-purpose model's behaviour caused or contributed to the event. | 41 | 32 | 3 | 1 |
Two families at once is the ordinary case. The corpus files a personal-data breach under privacy law whatever caused it, so a security incident that exposed personal data starts the breach clocks beside the security ones, and an AI system's malfunction that did the same starts three. The families are not alternatives; each is a yes-or-no question answered on its own.
3The fact pattern
Eight facts decide which clocks run and from when. Every one of them is an enumerated value, a place or a timestamp; none is a description. That is a deliberate shape: a description of an unreported breach is the narrative, and the narrative stays with the people who own it. The facts travel; the story does not.
| Fact | Values | What it decides |
|---|---|---|
| Personal data involved | yes, no, unknown | Whether the privacy family is engaged |
| Service or product security compromised | yes, no, unknown | Whether the security family is engaged |
| An AI system caused or contributed | yes, no, unknown | Whether the two AI families are engaged |
| Where the affected people live | A list of places | Widens the privacy family only (section 4) |
| The moments | Up to six timestamps (section 7) | The start of each clock |
| The time zone | A zone name | How a day lands on the calendar |
| The declaration | What the system does, and where it operates | Place reach, and which party roles the operator holds |
| The party roles | Read from the declaration | A duty written for a role the operator does not hold is held aside, with the role named |
Unknown is a real answer and it keeps the family in. An unanswered question is unknown, never no. A second set of facts is read against the sentences rather than against the families, and stays with the evidence that established it: the exact count of people per place, the categories of data, whether the data was encrypted and whether the key was exposed, and which component was hit. Section 6 says how each is read.
4Which places, and why the privacy family is different
Where the parties are, and whose law that makes applicable sets out what each body of law reaches through. For the clocks it comes down to one distinction.
| Family | Reached through |
|---|---|
| Security, and both AI families | The places the operator declares, widened to their parents and their union, because these instruments bind by establishment or by the market a product is placed on |
| Privacy | The declared places and the places the affected people live, both widened, because breach law generally follows the person whose data it is, and a declared footprint can be narrower than the people in the data |
A breach clock reached only through where the affected people live is never stated as binding. It runs unless counsel decides otherwise, with the reason written beside it: whether that law binds this operator there is a question of territorial scope, which is a legal conclusion and not a fact the data can settle. Every row records how it was reached, by the declaration, by the affected people, or by both.
5Three states, and no fourth
What a clock can be
- Runs
- The family's fact is yes, the place is declared, and the duty is written for a role the operator holds. The deadline is on the calendar.
- Runs unless
- Something would stop it and has not, and the row names the one thing and who decides. Two causes go to two people. Where the family's fact is unknown, the clock runs until you answer, and the answer is yours. Where the row was reached only through where the affected people live, or the sentence turns on a judgment standard, the clock runs unless counsel decides otherwise, and nobody else reads it as stopped.
- Set aside
- A stated fact took it off the calendar: the family's fact is no, or the duty is written for a role the operator does not hold. The row stays on the page with the fact beside it, dated and sourced, because the day the fact changes is the day the clock runs.
There is no state in which a clock disappears, and no state that reads as clearance. Four rules hold the shape. Not yet in force is not yet a clock: an instrument the corpus holds as enacted but not yet applying is on the page with that status beside it, and its clock starts on the day it applies, never before. A standard-only instrument always runs: "without undue delay" is a clock with no number, and the corpus holds 81 instruments across the four families whose only deadline is such a standard; dropping them because they cannot be drawn on an axis is how a duty gets lost. A place with no data is not a pass: every declared or affected place the corpus holds no clock row for is named, in those words. And a contract can be shorter than the statute: a processor's agreement with its controller commonly carries a notice period the law does not, and nothing on this page can see it.
6Reading the conditions inside a clock sentence
A clock sentence rarely runs unconditionally. It carries a threshold (a number of people, a category of data, a class of entity), a judgment standard (a risk to rights and freedoms, a significant harm), or a safe harbour (the data was encrypted and the key was safe). The rule for each kind is short, and the last column is the one that matters: who decides.
| The sentence's condition | The confirmed facts say | The reading |
|---|---|---|
| None | The state stands as section 5 gave it | |
| A judgment standard: risk, severity, significance, likelihood | Anything | Runs unless counsel decides otherwise. The sentence and its link go into the counsel brief. Nobody but counsel reads a judgment standard as unmet |
| A bright line: a count, a data category, an entity class | It is met | Runs |
| A bright line | It is not met | Set aside by that reading, carrying the fact, its evidence and who asserted it |
| A bright line | The fact is unknown | Runs unless that fact is established |
| An encryption safe harbour | Encrypted, and the key was not exposed, both confirmed | Set aside by that reading |
| An encryption safe harbour | Either half unknown | Runs unless both are established |
Three instruments show the three shapes, quoted from the corpus with each rung read out beside its sentence. The first turns on a judgment standard, the second is staged with bright deadlines and no threshold, the third carries a count threshold and a safe harbour.
European Union · GDPR Articles 33-34, Breach Notification, Regulation (EU) 2016/679, Arts. 33-34
- Notify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms. 72 hours, notification, from becoming aware without undue delay
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. without undue delay
European Union · Cyber Resilience Act, Manufacturer Reporting Obligations, Regulation (EU) 2024/2847, Art. 14
- Notify the CSIRT designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available. 24 hours, early warning, from becoming aware 72 hours, notification, from becoming aware 14 days, final report, from a corrective measure
- Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification. 24 hours, early warning, from becoming aware 72 hours, notification, from becoming aware 1 month, final report, from the notification
California · California Data Breach Notification Law, as amended by SB 446, Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319)
- Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification. 30 days, notification, from becoming aware
- Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents. 15 days, notification, from the notification
A reading is labelled with who made it. A person reading a sentence against the facts, or a tool reading it on that person's behalf, adds the reading beside the state and never overwrites it, so a later reader can see that a clock was set aside by an encryption finding rather than by the family question, and can ask who established the finding.
7The six moments a clock counts from
An ordering of clocks by length is not an ordering by expiry, because the clocks start from different moments. The corpus reads the start out of each sentence, and the reading is one of six. The counts are clocks, not instruments; a staged duty is several clocks.
| Moment | What the statutes call it | Clocks counting from it |
|---|---|---|
| You became aware | Written “after becoming aware” in the European instruments and “discovery”, “determining” or “confirming” a breach in most US state laws: the point at which you knew an incident had happened, as distinct from the first alert. | 231 |
| You detected it | The technical moment. A few instruments count from detection itself rather than from awareness, so their clocks start at the alert. | 21 |
| The notification went out | The submission of the incident notification. A final report usually counts from it, and some regulator notices count from the notice you gave the people affected. | 41 |
| A corrective measure became available | The Cyber Resilience Act counts a vulnerability's final report from the day a corrective or mitigating measure becomes available. | 1 |
| The incident was resolved | Most national transpositions of the second Network and Information Security Directive count a still-running incident's final report from its resolution. | 21 |
| The event happened | A few instruments count from the event itself rather than from anyone noticing it. | 7 |
| Unstated | The sentence names a period and no start. The clock is listed and never dated from a guess. | 20 |
The first alert is not it. Awareness is the point at which the operator knew that an incident had happened, and most clocks count from there. It is a judgment about a sequence of events, made by a person and recorded with its basis, not a timestamp a log emits. A tool may collect the alerts, the detection and the fix from the systems that hold them; it does not decide when you became aware.
8What to record
The reading will be examined later, by a regulator asking why a notice came when it did or by counsel deciding whether one is owed. What survives that examination is a record of facts with their sources, not a conclusion. Five things belong in it.
- Each fact, with its source and its age. Declared by the operator, answered by a person, observed in a system with the place it was read from, or determined by counsel. An absent fact is an assumption stated as one, never a default.
- Every clock in its state, the set-aside ones included, each with the fact or the role that decided it and the moment it counts from.
- The counsel brief: every sentence that turns on a judgment standard, with the sentence and its instrument's page, and every row reached only through where the affected people live.
- The places the corpus holds no clock for, named, and the standing line that a contract may carry a shorter period than the statute.
- The jurisdiction each request was served under, which is the field Jurisdiction in logs argues an agent's own record has to carry, and the reason the affected places can be read from the record rather than reconstructed under a deadline.
The record is itself evidence with duties of its own, the classes and retention periods of What you must be able to show, and it is personal data the moment it names a person. A reading is a fact about how the law was read on a date, from stated inputs; it is never the sentence that a law does not apply. That sentence is a determination, and a determination is counsel's, signed.
9Where to work it today
The clocks an incident starts carries every clock with its sentence and, for a signed-in project, keeps only the instruments the project's declaration reaches. The project's incident page on my.lexlint.org takes the same rows and the six moments and lays every clock the declaration reaches on the calendar, in the project's zone, with nothing stored: the address of the page is the record. The family questions, the affected places and the readings of section 6 are applied against that calendar by the people who hold the facts, and the counsel brief is written from it. The demo account can work the page on its sample projects.
10What this document does not claim
It does not say which notices any particular incident requires. The method sorts the corpus's clocks into states from stated facts; whether a judgment standard is met, whether a law binds an operator in a place, and whether a notice is owed are conclusions for counsel. The clocks are read from the corpus's sentences on the date in the byline, and the corpus does not hold every contract, sectoral rule or supervisory instruction that can shorten a period. Nothing here is legal advice.