Reporting clocks: the deadlines an incident starts, and how to read them
About this documentUpdated ShowHide
Sean McDermott, Co-Founder and CEO, UnGovr
Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.
Every law named here links to its summary page on lexlint.io, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.
© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same license. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.
Law library as of .
Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice in the footer says what that means.
An incident involving an agent starts reporting clocks in the law of every jurisdiction where the affected systems and people are: the incident and vulnerability duties of cybersecurity law, the breach duties of privacy law and the serious-incident duties of the AI laws. This document says what a reporting clock is, which families of law set one, how a deadline is read from the sentence that carries it, and what the clocks ask of an agent. The clocks themselves, every one in the LexLint law library on one time axis with its sentence beside it, are the clocks page.
When something has happened
Every reporting clock in the law library on one time axis, one flag per clock, each with the sentence it was read from. This document is what to read beside it.
1What a reporting clock is
A reporting clock is a deadline a law starts when something has gone wrong: a period, counted from a moment the law names, by the end of which a report or a notice has to reach a regulator, a national authority or the people affected. An incident involving an AGENT, a credential it leaked, a tool it misused, a system it took down, a person's data it exposed, starts clocks in the law of every jurisdiction where the affected systems and people are. None of those clocks was written for agents. They are the incident and vulnerability reporting duties of cybersecurity law, the breach notification duties of privacy law and the serious-incident duties of the AI laws, and the LexLint law library holds them by jurisdiction, each with the sentence that carries the clock and a link to the primary source.
The clocks page is the reference: every reporting clock the law library holds, drawn on one time axis from the first hour to the ninetieth day, with the sentence each was read from, a filter for the jurisdictions a project declares, and the Open Secure AI Alliance's SAFE timeline on the same scale, closing with how a missed or misleading notice has been enforced. It stands outside this handbook so it can be opened on its own when something has happened. Guidance that states a clock of its own appears on the clocks page beside the law it reads, labeled as guidance, and no figure here counts it. This document is what to read before it, or beside it: what the clocks are, how they are read, and what they ask of an agent. Which of them one incident actually starts is Incident command, the document after this one.
2Four families of law set one
The law library holds reporting clocks in four families of law, and one incident can start clocks in more than one of them. The law library files a personal-data breach under privacy law whatever caused it, so a security incident that exposes personal data starts the privacy clock beside the security one. The count in each row is the instruments in that family whose obligation lines state a deadline, as a number or as a standard such as "without undue delay", as of ; each family's name opens its tables on the clocks page.
| Family | Who the duty binds, and who receives the report | Instruments stating a deadline |
|---|---|---|
| Security law: incident and vulnerability reporting | The OPERATOR of a service in the scope of the second Network and Information Security Directive or its national transposition, reporting to the national authority or its incident response team; the Cyber Resilience Act binds the MAKER of a product with digital elements, software included. | 319 in 175 jurisdictions |
| Privacy law: personal-data breach notification | The party that decides why and how personal data is processed, for an agent nearly always its OPERATOR, reporting to the supervisory authority and, separately, to the people affected. | 224 in 185 jurisdictions |
| AI law, high-risk systems: serious-incident reporting | The MAKER of a system classified high-risk, reporting to the market surveillance authority, with a shorter duty on the OPERATOR that identifies the incident first. | 17 in 9 jurisdictions |
| AI law, frontier models: safety-incident reporting | The MAKER of a frontier model, reached by a compute or capability threshold, reporting to a state agency: California's Office of Emergency Services, New York's Attorney General. | 8 in 7 jurisdictions |
3Stages, and what a clock counts from
Most security clocks are staged: an early warning, a fuller notification, then a final report, and each stage is a rung of its own. The rungs count from different moments: becoming aware of the incident in most rows, detecting it in some, the notification itself for a final report, a corrective measure becoming available for a vulnerability's final report. Two clocks of the same length can therefore expire days apart, and an ordering by length is not an ordering by expiry. The law library's own count of clocks by starting moment, with the words each instrument uses for it, is in Incident command.
A clock is also not always a number. A standard such as "immediately" or "without undue delay" is a deadline the law leaves to be argued afterwards, and the clocks page counts those beside the numeric ones in every family, because an instrument that states only a standard still runs.
4Reading the clocks: seven notes on how a rung is read from its sentence
The rung a law sits on is read from the sentence that carries it, and the clocks page prints the sentence beside every rung so the reading can be checked against the words. These are the rules of that reading.
- Read from the sentence
- The law library keeps each clock inside the obligation sentence and has not yet given it a field of its own. The rung a row sits on is read out of that sentence when the clocks page is built: a number followed by minutes, hours, days, weeks or months, in a line about notifying, reporting or requesting an authorization, not preceded by a word that makes it a floor, a retention window, a remedy period or a resolution test, and no longer than sixty days, because every longer period in these lines is one of those. A lead time before an event (“60 days in advance”), an authority’s own time to answer, a period counted from the end of a calendar year and a reply to a person’s request about their own data are not drawn either. A window with a floor and a ceiling (“no less than 48 hours and no more than seven days”) is drawn at both ends. A report that repeats ("a progress report every fifteen days") is drawn once, at its first due date, and the tables say it repeats. A number the sentence sets aside ("in place of the 72-hour notification") or only uses to name an earlier deadline ("one month after the 72-hour notification") is not drawn. A sentence that points at another sentence’s deadline instead of stating one ("on the same clock", a progress report due "when the final report falls due") is drawn at that deadline.
- A clock an incident starts
- Three of the four families are named for the event, so every reporting clock in them is one an incident starts. The frontier-model family is named for governance and holds other duties too, so a rung is drawn there only where the sentence names the event: an audit remediation report and a content-complaint status update are periods in that family, and neither is started by an incident.
- Different starts
- The clocks run from different moments: becoming aware of the incident in most rows, detecting it in some, the incident notification for a final report, the end of handling for the final report on an incident still ongoing, a corrective measure becoming available for a vulnerability's final report, and the assessment of whether the incident must be reported for the few laws that count from that step (Singapore's and Brunei's privacy laws, the European Union's Digital Operational Resilience Act, the Securities and Exchange Commission's Form 8-K rule). A start that is none of these, such as a law enforcement agency clearing the notice it delayed, is quoted in the sentence's own words and given none of these names. An ordering by length is not an ordering by expiry.
- Staged
- Most security clocks are staged: an early warning, a fuller notification, a final report. Each stage is a rung, and the tables on the clocks page show every stage sentence.
- Two families at once
- The law library files a personal-data breach under privacy law whatever caused it, so a security incident that exposes personal data starts the privacy clock beside the security one.
- Business days
- A rung stated in business or working days is drawn at its calendar length and marked.
- A compact, not a law
- The SAFE rungs are quoted from version 1.0 of the alliance's compact, dated and read on . It is voluntary to join and it is not law; it says that “SAFE reporting complements applicable legal, contractual and coordinated-disclosure duties; it does not replace or extend their deadlines.” Every other rung is a statute or regulation the law library holds, with its status beside it.
Every clock runs from a moment the reporting party has to establish and evidence: awareness, detection, a materiality finding, a corrective measure. An AGENT that keeps the record of what it did, when, and on whose instruction gives its OPERATOR the thing every report is built from; The 6 parties says which party that is in each arrangement, and What you must be able to show says what the record has to hold.
When something has happened, open the clocks page with the project's declaration and read Incident command beside it: the first says which clocks exist and where the text is, the second which of them this event starts, for this operator, in these jurisdictions, from which moment.