Skip to main content
← All use cases
Use case

The 03:12 emergency: one incident, four statutory clocks — every notification drafted in minutes

Ransomware hits a municipal utility. The moment the crisis team becomes aware, four deadlines start at once: 24 hours for the early warning to the BSI, 72 hours for the full notification, 72 hours for the parallel GDPR Art. 33 report to the supervisory authority, one month for the final report. Six agents produce all five documents ready for decision — every statement carrying its article and paragraph, every unconfirmed point marked unconfirmed. Filing and release stay human acts.

Book a demo All use cases
24 h · 72 h
early warning and notification to the BSI — Art. 23(4) NIS2 · § 32 BSIG
Two clocks
NIS2 and GDPR Art. 33 run in parallel — different authority, different content
Release
drafts for the human — the filing stays your act
Demo in German, English and Spanish
The starting point

The clock runs from the moment of awareness, not from the attack — and it runs at night, on holiday and at the weekend. Four addressees need four different contents: the BSI, the data-protection authority, the customers, the management board. Teams that sort this out only during the incident lose the first hours to the question of who is even allowed to file.

How it works
1

Set the clock and test significance

The Incident Commander fixes the moment of awareness and derives every deadline from it as an absolute date-time. Both limbs of Art. 23(3) NIS2 are assessed separately — a one-sentence verdict, with the criterion that carries it.

2

Five notifications in parallel, each to its addressee

The early warning and the 72-hour notification to the BSI, the GDPR report to the supervisory authority, the customer notification under § 35 BSIG and the one-page board briefing under § 38 BSIG are drafted at the same time — each section headed with its legal basis.

3

Open stays open — and the release stays human

Every draft carries an explicit section on what is not yet established at this hour. The 24-hour early warning legally does not require a completed assessment. Filing and release are done by the entity, not by the platform.

The outcome
24 h · 72 h
early warning and notification to the BSI — Art. 23(4) NIS2 · § 32 BSIG
Two clocks
NIS2 and GDPR Art. 33 run in parallel — different authority, different content
Release
drafts for the human — the filing stays your act
Grounded in

Grounded in Directive (EU) 2022/2555 and its German transposition: BSIG 2025 (NIS2UmsuCG, in force since 06.12.2025) — §§ 28, 30–35, 38, 65 — plus GDPR Art. 33/34. Drafting support, not legal advice: reporting and release are the responsibility of the entity.

Book a demo

See it on your own use case.

30 minutes, scoped to your industry, frameworks and integrations. You leave with a concrete scenario — not a sales loop.