Compliance & reporting

Legal/Compliance Engine (Module 6) and Phase 5 of the response chain. The engine translates a classified incident into regulatory obligations, generates report templates for authorities while honouring statutory deadlines, and maintains an auditable decision log. Doctrine: claim ≤ proof — no report leaves the system without an associated chain of evidence.

1. Legal flags — glossary

The Classification Engine sets the following boolean flags on the incident record. Each active flag triggers the corresponding report template and a deadline clock.

FRAMEWORK/NORM The above is an interpretation of obligations based on the publicly known text of the regulations — not legal advice for a specific set of facts.

2. Report templates for authorities

2.1 AI Act art. 73 — serious incident

FRAMEWORK/NORM The AI Act provides for prompt reporting once a causal link (or its reasonable likelihood) is established, with deadlines depending on the scale of impact. The system does not replace the provider's legal assessment.

2.2 NIS2 — three-stage notification path

FRAMEWORK/NORM The 24h/72h/1-month path mirrors the regime of NIS2 art. 23. While an incident is ongoing, interim reports may be requested by the authority.

2.3 GDPR art. 33 / 34 — personal data breach

3. DPO / Legal workflow

1. Trigger: the incident receives the GDPR_PERSONAL_DATA flag → automatic assignment of the Legal/DPO role.
2. Breach assessment: the DPO decides whether the event is a GDPR_BREACH (loss of confidentiality/integrity/availability). Decision + rationale recorded in the log.
3. 72h clock: from becoming aware of the breach, the system counts down the art. 33 deadline; a visible counter on the Legal Board.
4. Risk assessment for individuals: if high risk → the art. 34 path is triggered.
5. Draft + dispatch: template populated with data from the Evidence Layer; the DPO approves, the Operator sends.
6. Closure: delivery confirmation + the authority's case number attached to the record.

4. Human-in-the-loop decision log

Every decision affecting the legal regime or a high-risk action is logged verifiably (who, when, on what evidentiary basis). This is the foundation of auditability towards financial, data protection, and AI market surveillance authorities.

The rows above are SIMULATION — demonstration data illustrating the log structure, not real decisions.

5. Evidentiary export

The engine generates an evidence bundle attached to each report. Integrity is ensured by a chained hash (chain-of-custody), so that the material is usable in proceedings before an authority or court.

POST /api/incidents/:id/export
{
  "format": "evidence-bundle",     // pdf-signed | json-manifest | evidence-bundle
  "include": ["timeline","evidence","classification","decisions","report"],
  "seal": "sha256-chain",          // hash of each artifact + aggregate hash
  "recipient": "CSIRT | DPA | market-surveillance"
}
--> 200 { "bundle_id":"EXB-0091", "sealed_hash":"…", "artifacts": 14 }

6. Deadline calendar (norm frameworks)

FRAMEWORK/NORM The calendar mirrors statutory deadlines; it does not refer to any real incident. Clocks start only after a real event has been classified.

7. AI Act context — application timeline

8. Definition of done v1.0 (Legal/Compliance Engine)

1. Glossary of 9 legal flags with operational definitions — DONE.
2. Mapping flag → regime → deadline → authority — DONE.
3. AI Act art. 73 template (serious incident) — DONE.
4. NIS2 path 24h / 72h / final report — DONE.
5. GDPR art. 33 (supervisory authority) and art. 34 (individuals) templates — DONE.
6. DPO workflow with 72h clock — DONE.
7. Human-in-the-loop decision log (verifiable) — DONE.
8. Evidentiary export with chain-of-custody (chained hash) — DONE.
9. Deadline calendar as norm frameworks (not incidents) — DONE.
10. Integration with the Classification Engine (reading flags) — TO BE WIRED (interface defined).
11. Integration with the Evidence Board (artifact source) — TO BE WIRED.
12. AI Act context (art. 50 / Annex III deferral) documented — DONE.
13. claim ≤ proof doctrine enforced in export — DONE.

Related: Legal Board · Classification Engine · Evidence Board · AI Act Playbook · Data breach Playbook · Banking demo