RedHub AI
How the gate works
How the AI Incident Reporting & Regulatory-Notification Drill works
This tool grades one incident scenario's notification process on six weighted controls — whether you would actually notify the right regulators in time. It scores 6 weighted controls into a 0–100 number — then a gate that can only make the verdict worse.
The 6 weighted controls
The three clock-start controls are what let you begin counting a notification deadline: detection-to-awareness, severity & regime triage, and a named decision-maker who can start the clock. If you can't establish in time that the clock has started — detection or triage at zero — OR no one is empowered to start it — the clock-starter at zero — the verdict is WOULD MISS THE CLOCK regardless of the score. The gate worsens only; it never promotes a verdict. A deadline you can't start counting is a deadline you miss.
Why: This AI-Act-serious-incident drill scores 82 — detection, triage, regulator contacts, drafting, and coordination all strong — which on the number alone reads NOTIFIABLE-READY. But no one is empowered to declare awareness and start the clock: the clock-starter control is at zero. The clock-start gate fires, so the verdict is WOULD MISS THE CLOCK, not NOTIFIABLE-READY — a deadline you can't start counting is a deadline you miss.
A high score didn’t save it. The score is context; the gate is the answer — and it names the one thing to fix first. Not legal advice. This is a readiness drill that grades your notification process from your own marks. It is date-agnostic and asserts no deadline; it files nothing, confirms no regulatory obligation, and scores no people. Notification duties (GDPR, the EU AI Act, SEC, HIPAA, and US state breach laws) vary by jurisdiction and change often — confirm which apply to you and every deadline with qualified counsel.