Use this as soon as triage flags any clock as yes or unknown, and re-run it each time the facts change. You get, in a new folder ./regulatory-incident-reporting-clock/, a running record of every reporting deadline, recipient and owner (<incident-id>-clock.md), and one draft notice per recipient, for a person to check and send (drafts/). This skill drafts for a human to review and sign; this skill never marks a control effective. Nothing is sent by the agent; the decision to notify and every submission belong to the named owners.

Inputs to gather

Read the triage record, the timeline, the processing records for affected systems, regulatory status notes, contracts with notification clauses and the insurance policy. Ask the reader, in one message: the awareness time and how it was established, what data and services are affected and for how many people or customers, in which countries, whether the company is controller or processor for that data, and whether it is an entity in NIS 2 scope, a financial entity under DORA, or a HIPAA covered entity or business associate.

Step 1: fix the facts that drive every clock

Write in UTC: detection time, awareness time with the reasoning, what is known and unknown, data categories and approximate counts, services and countries affected, whether the incident is ongoing. Deadlines run from awareness, not from the end of the investigation. Record also when anyone in the workforce first knew or, with reasonable diligence, would have known: HIPAA treats that as discovery (164.404(a)(2)), which can start the clock before the incident team's own awareness. Most regimes accept an initial notice with gaps filled later.

Step 2: test each regime that may apply

For each, record: applies, does not apply, or unclear, with the deciding fact.

GDPR: a controller notifies the competent supervisory authority without undue delay and where feasible within 72 hours of awareness, unless the breach is unlikely to result in a risk to people (Art. 33); information may be given in phases (Art. 33(4)). Affected people are told without undue delay when the risk to them is high (Art. 34), unless an Art. 34(3) exception holds, such as data made unintelligible by encryption. A processor tells the controller without undue delay (Art. 33(2)). Every breach is documented internally, notified or not (Art. 33(5)).
NIS 2: for a significant incident, an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month of the notification, with intermediate reports on request (Art. 23); if the incident is still ongoing then, a progress report is due and the final report follows within one month of its handling ending. Service recipients may need to be told. Thresholds and the receiving body come from national transposition and, for some digital providers, an implementing regulation; check the member state law.
DORA: a financial entity classifies ICT-related incidents against the criteria in Art. 18 and reports major ones to its competent authority (Art. 19), with initial, intermediate and final reports; clients are informed when their financial interests are affected. Content and time limits sit in the technical standards adopted under Art. 20; read the current text.
HIPAA: for a breach of unsecured protected health information, individuals are notified without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404); HHS at the same time for 500 or more people, or in the annual log for fewer (164.408); media when more than 500 residents of a state or jurisdiction are affected (164.406); a business associate notifies the covered entity no later than 60 days after discovery (164.410). Encrypted data meeting HHS guidance is secured and not notifiable, and law enforcement may request a delay (164.412). A documented risk assessment can show a low probability of compromise (164.402).
Contracts and others: customer processing agreements (often 24 to 72 hours, and stricter than the law for a processor: build that draft to the contract), insurance notice conditions, payment partners, sector regulators, and US state breach laws where residents are affected.