An AI incident can start aregulatory clock you can’t see.

It grades whether your notification process is ready for the reporting periods an AI incident could trigger — scenario by scenario. For each drilled incident you mark six controls 0/1/2: your detection-to-awareness path, regime, trigger, and severity triage, whether a named person is authorized to assess potential trigger points and escalate, your regulator contact map and filing channel, your notification drafting and incident-record path, and cross-track coordination. The six are weighted to a 0–100 score banded NOTIFIABLE-READY AS DESCRIBED, TIGHTEN, or WOULD MISS THE CLOCK, and the program rolls up to DRILL-READY, GAPS, or WOULD MISS NOTIFICATION. It grades the process, never people, and never asserts a deadline as the verdict.

Because of the trigger-assessment gate, which is the heart of the drill. A scenario is forced to WOULD MISS THE CLOCK regardless of score when either gate-triggering pattern is present: you could not recognize and assess a potential trigger in time (your detection-to-awareness path or your regime, trigger, and severity triage is absent), or no one is authorized to assess and document potential trigger points and activate the appropriate escalation path. The deadline is rarely the hard part — the hard part is that a potentially applicable reporting period can begin at a trigger you may not recognize or assess, so days burn before anyone registers it. Different regimes attach reporting periods to different facts, knowledge standards, or determinations. Record detection, discovery, awareness, escalation, materiality assessment, and other potentially relevant trigger points separately. In the worked example a model-failure scenario scores 82 yet reads WOULD MISS THE CLOCK because no one is authorized to assess potential trigger points and escalate; the next row is the same incident after naming an on-call authorized decision-maker, and it clears at 100. The gate worsens only — it never promotes a verdict.

An AI incident rarely triggers only one reporting period. The same event can trigger a personal-data breach notification (e.g. GDPR Article 33, under which, where required, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal-data breach), an AI safety / serious-incident report (e.g. EU AI Act Article 73, which principally imposes serious-incident reporting duties on providers of covered high-risk AI systems, with different periods for specified incident categories), a material-cyber disclosure (e.g. SEC Item 1.05, under which domestic registrants generally file Item 1.05 Form 8-K within four business days after determining that a cybersecurity incident is material; the determination may not be unreasonably delayed following discovery), sector duties like HIPAA breach notification (for a covered entity, HIPAA discovery occurs when the breach is known or would have been known through reasonable diligence; analyze individual, HHS, media, and business-associate notification paths separately), and US state breach laws with their own windows. Potentially applicable regimes may use different triggers, recipients, content, deadlines, and exceptions. For rehearsal only, the drill uses the shortest potentially applicable period as an internal triage target; meeting one regime’s process does not establish that another is satisfied. These specifics are named in the playbooks as planning references — the engine itself is deliberately date-agnostic so it does not break when a regime’s dates shift. Which regimes apply to you, and every deadline, must be confirmed with qualified counsel.

Because the deadlines move, and a tool that hard-codes a date is wrong the moment a regime shifts. The EU AI Act’s high-risk timeline, state breach windows, and sector rules all change. So the drill grades the thing that actually determines whether you hit any clock — your process for recognizing and assessing potential trigger points, escalating, and filing — rather than checking a calendar. That makes the verdict durable, and it keeps the tool honest: it tells you whether you would be ready, not whether a specific statute applies to you. Which regimes apply, and every deadline, must be confirmed with counsel.

No. It is a readiness drill that grades your notification process from your own marks. It files nothing, contacts no regulator, connects to no system, and confirms no actual regulatory obligation — it cannot tell you whether a given incident is legally reportable or to whom. It is not legal advice, a filing service, a certification, or a safe harbor, and it scores a process, never people. Use it to find and close the gaps in your incident-notification readiness, then confirm which regimes apply to you and every applicable deadline with qualified counsel.

A runnable zero-dependency Python engine, a workbook that reproduces it exactly (Start Here, Dashboard, and a Drill Scorecard with the mark definitions built into each column), a six-scenario worked example, and two playbooks: a Drill Facilitator Playbook for running the tabletop and marking honestly, and a Notification-Readiness Runbook that sets the controls beside several regimes as planning references and walks the trigger-assessment, triage, and filing steps. Pick the incident types that matter to you — a data breach, an AI serious incident, a material cyber event — drill each one, and, where a control is short, close the one the tool names first. Deterministic and offline; one-time purchase, lifetime access, 12 months of updates.