An AI incident starts aregulatory clock you can’t see.

It grades whether your process could meet a regulatory notification clock when an AI incident hits — scenario by scenario. For each drilled incident you mark six controls 0/1/2: your detection-to-awareness path, severity and regime triage, whether a named person can start the clock, your regulator contact map and filing channel, your drafting path and breach register, and cross-track coordination. The six are weighted to a 0–100 score banded NOTIFIABLE-READY, TIGHTEN, or WOULD MISS THE CLOCK, and the program rolls up to DRILL-READY, GAPS, or WOULD MISS NOTIFICATION. It grades the process, never people, and never asserts a deadline as the verdict.

Because of the clock-start gate, which is the heart of the drill. A scenario is forced to WOULD MISS THE CLOCK regardless of score when either fatal pattern is present: you could not establish in time that the clock has started (your detection-to-awareness path or your severity/regime triage is absent), or no one is empowered to start the clock. The deadline is rarely the hard part — the hard part is that the clock starts at a trigger event you may not recognize, or that no one is authorized to call, so days burn before the countdown even registers. In the worked example a model-failure scenario scores 82 yet reads WOULD MISS THE CLOCK because no one can start the clock; the next row is the same incident after naming an on-call clock-starter, and it clears at 100. The gate worsens only — it never promotes a verdict.

An AI incident rarely fires one clock. The same event can trigger a personal-data breach notification (e.g. GDPR’s 72-hour rule, which starts at “awareness,” not detection), an AI safety / serious-incident report (e.g. the EU AI Act’s tiered 2/10/15-day Article 73 regime), a material-cyber disclosure (e.g. the SEC’s four-business-day clock, which starts at the materiality determination), sector duties like HIPAA’s 60-day rule, and US state breach laws with their own windows. The strictest applicable clock governs. These specifics are named in the playbooks as planning references — the engine itself is deliberately date-agnostic so it does not break when a regime’s dates shift.

Because the deadlines move, and a tool that hard-codes a date is wrong the moment a regime shifts. The EU AI Act’s high-risk timeline, state breach windows, and sector rules all change. So the drill grades the thing that actually determines whether you hit any clock — your process for recognizing the trigger, starting the count, and filing — rather than checking a calendar. That makes the verdict durable, and it keeps the tool honest: it tells you whether you would be ready, not whether a specific statute applies to you. Which regimes apply, and every deadline, must be confirmed with counsel.

No. It is a readiness drill that grades your notification process from your own marks. It files nothing, contacts no regulator, connects to no system, and confirms no actual regulatory obligation — it cannot tell you whether a given incident is legally reportable or to whom. It is not legal advice, a filing service, a certification, or a safe harbor, and it scores a process, never people. Use it to find and close the gaps in your incident-notification readiness, then confirm which regimes apply to you and every applicable deadline with qualified counsel.

A runnable zero-dependency Python engine, a workbook that reproduces it exactly (Start Here, Dashboard, and a Drill Scorecard with the mark definitions built into each column), a six-scenario worked example, and two playbooks: a Drill Facilitator Playbook for running the tabletop and marking honestly, and a Notification-Readiness Runbook that maps the controls to the major regimes and walks the clock-start, triage, and filing steps. Pick the incident types that matter to you — a data breach, an AI serious incident, a material cyber event — drill each one, and close the control the tool names first. Deterministic and offline; one-time purchase, lifetime access, 12 months of updates.