RedHub AI
How the gate works
How the AI Incident Reporting & Regulatory-Notification Drill works
This tool grades one incident scenario's notification process on six weighted controls — how ready your process is to notify the right regulators in time, on your own marks. It scores 6 weighted controls into a 0–100 number — then a gate that can only make the verdict worse.
The 6 weighted controls
The three clock-start controls are what let you notice in time that a clock has already started: detection-to-awareness, severity & regime triage, and a named decision-maker who can start the clock. If you can't establish in time that the clock has started — detection or triage at zero — OR no one is empowered to start it — the clock-starter at zero — the verdict is WOULD MISS THE CLOCK regardless of the score. The gate worsens only; it never promotes a verdict. A deadline you can't start counting is a deadline you are unlikely to meet.
Why: This hypothetical Annex III serious-incident drill scores 82 — detection, triage, regulator contacts, drafting, and coordination all strong — which on the number alone reads NOTIFIABLE-READY AS DESCRIBED. But no one is empowered to declare awareness and start the clock: the clock-starter control is at zero. The clock-start gate fires, so the verdict is WOULD MISS THE CLOCK, not NOTIFIABLE-READY AS DESCRIBED — a deadline you can't start counting is a deadline you are unlikely to meet.
A high score didn’t save it. The score is context; the gate is the answer — and where something is short, the fix first row names it. Not legal advice. This is a readiness drill that grades your notification process from your own marks. It is date-agnostic and asserts no deadline; it files nothing, confirms no regulatory obligation, and scores no people. Notification duties (GDPR, the EU AI Act, SEC, HIPAA, and US state breach laws) vary by jurisdiction and change often — confirm which apply to you and every deadline with qualified counsel.