Reporting clocks: the deadlines an incident starts, and how to read them
About this documentUpdated 2026-09-23ShowHide
Sean McDermott, Co-Founder and CEO, UnGovr
Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.
Every law named here links to its summary page on lexlint.io, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.
© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same licence. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.
Corpus figures as of 2026-09-21.
Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice at the foot says what that means.
An incident involving an agent starts reporting clocks in the law of every place the affected systems and people are: the incident and vulnerability duties of cybersecurity law, the breach duties of privacy law and the serious-incident duties of the AI laws. This document says what a reporting clock is, which families of law set one, how a deadline is read from the sentence that carries it, and what the clocks ask of an agent. The clocks themselves, every one in the corpus on one time axis with its sentence beside it, are the clocks page.
1What a reporting clock is
A reporting clock is a deadline a law starts when something has gone wrong: a period, counted from a moment the law names, by the end of which a report or a notice has to reach a regulator, a national authority or the people affected. An incident involving an AGENT, a credential it leaked, a tool it misused, a system it took down, a person's data it exposed, starts clocks in the law of every place the affected systems and people are. None of those clocks was written for agents. They are the incident and vulnerability reporting duties of cybersecurity law, the breach notification duties of privacy law and the serious-incident duties of the AI laws, and the corpus holds them by jurisdiction, each with the sentence that carries the clock and a link to the primary source.
The clocks page is the reference: every reporting clock the corpus holds, drawn on one time axis from the first hour to the ninetieth day, with the sentence each was read from, a filter for the places a project declares, and the Open Secure AI Alliance's proposed SAFE timeline on the same scale, closing with how a missed or misleading notice has been enforced. It stands outside this handbook so it can be opened on its own when something has happened. This document is what to read before it, or beside it: what the clocks are, how they are read, and what they ask of an agent. Which of them one incident actually starts is Incident command, the document after this one.
2Four families of law set one
The corpus holds reporting clocks in four families of law, and one incident can start clocks in more than one of them. The corpus files a personal-data breach under privacy law whatever caused it, so a security incident that exposes personal data starts the privacy clock beside the security one. The count in each row is the instruments in that family whose obligation lines state a deadline, as a number or as a standard such as "without undue delay", as of 2026-09-21; each family's name opens its tables on the clocks page.
| Family | Who the duty binds, and who receives the report | Instruments stating a deadline |
|---|---|---|
| Security law: incident and vulnerability reporting | The OPERATOR of a service in the scope of the second Network and Information Security Directive or its national transposition, reporting to the national authority or its incident response team; the Cyber Resilience Act binds the MAKER of a product with digital elements, software included. | 75 in 63 jurisdictions |
| Privacy law: personal-data breach notification | The party that decides why and how personal data is processed, for an agent nearly always its OPERATOR, reporting to the supervisory authority and, separately, to the people affected. | 167 in 162 jurisdictions |
| AI law, high-risk systems: serious-incident reporting | The MAKER of a system classified high-risk, reporting to the market surveillance authority, with a shorter duty on the OPERATOR that identifies the incident first. | 3 in 3 jurisdictions |
| AI law, frontier models: safety-incident reporting | The MAKER of a frontier model, reached by a compute or capability threshold, reporting to a state agency: California's Office of Emergency Services, New York's Attorney General. | 4 in 4 jurisdictions |
3Stages, and what a clock counts from
Most security clocks are staged: an early warning, a fuller notification, then a final report, and each stage is a rung of its own. The rungs count from different moments: becoming aware of the incident in most rows, detecting it in some, the notification itself for a final report, a corrective measure becoming available for a vulnerability's final report. Two clocks of the same length can therefore expire days apart, and an ordering by length is not an ordering by expiry. The corpus's own count of clocks by starting moment, with the words each instrument uses for it, is in Incident command.
A clock is also not always a number. A standard such as "immediately" or "without undue delay" is a deadline the law leaves to be argued afterwards, and the clocks page counts those beside the numeric ones in every family, because an instrument that states only a standard still runs.
4Reading the clocks: seven notes on how a rung is read from its sentence
The rung a law sits on is read from the sentence that carries it, and the clocks page prints the sentence beside every rung so the reading can be checked against the words. These are the rules of that reading.
- Read from the sentence
- The corpus keeps each clock inside the obligation sentence and has not yet given it a field of its own. The rung a row sits on is read out of that sentence when the clocks page is built: a number followed by hours, days, weeks or months, in a line about notifying or reporting, not preceded by a word that makes it a floor, a retention window, a remedy period or a resolution test, and no longer than sixty days, because every longer period in these lines is one of those. A recurring cadence ("a progress report every fifteen days") is not drawn either.
- A clock an incident starts
- Three of the four families are named for the event, so every reporting clock in them is one an incident starts. The frontier-model family is named for governance and holds other duties too, so a rung is drawn there only where the sentence names the event: an audit remediation report and a content-complaint status update are periods in that family, and neither is started by an incident.
- Different starts
- The clocks run from different moments: becoming aware of the incident in most rows, detecting it in some, the incident notification for a final report, a corrective measure becoming available for a vulnerability's final report. An ordering by length is not an ordering by expiry.
- Staged
- Most security clocks are staged: an early warning, a fuller notification, a final report. Each stage is a rung, and the tables on the clocks page show every stage sentence.
- Two families at once
- The corpus files a personal-data breach under privacy law whatever caused it, so a security incident that exposes personal data starts the privacy clock beside the security one.
- Business days
- A rung stated in business or working days is drawn at its calendar length and marked.
- A proposal, not a law
- The SAFE rungs are a scheme's proposal, quoted as read on 2026-09-18 while it was open for comment. Every other rung is a statute or regulation the corpus holds, with its status beside it.
Every clock runs from a moment the reporting party has to establish and evidence: awareness, detection, a materiality finding, a corrective measure. An AGENT that keeps the record of what it did, when, and on whose instruction gives its OPERATOR the thing every report is built from; The 6 parties says which party that is in each arrangement, and What you must be able to show says what the record has to hold.
When something has happened, open the clocks page with the project's declaration and read Incident command beside it: the first says which clocks exist and where the text is, the second which of them this event starts, for this operator, in these places, from which moment.