Incident Disclosure Agent
Drafts every notification while the clock is running — and sends none of them
4 of 8 incidents missed or are about to miss their notification deadline, 20,560 records involved.
8 incidents checked. 4 are flagged, 20,560 records in total. The longest delay or margin is 31 hours.
Deal with INC-401 first. EU (GDPR) has the most records flagged.
Whether an incident must be notified at all (risk to people) is a legal judgement, not in the data.
Why rows were flagged
- Not notified, deadline passed50%
- Notified after the deadline25%
- Not notified, under 24 hours left25%
Value flagged by Jurisdiction
- EU (GDPR)2
- UAE1
- UK1
Items to act on, worst first
| Item | Jurisdiction | Value | Hours late or left | Why |
|---|---|---|---|---|
| INC-401 | EU (GDPR) | 12,400 | 31 | Notified after the deadline |
| INC-406 | UAE | 4,200 | 16 | Not notified, deadline passed |
| INC-402 | EU (GDPR) | 3,100 | 22 | Not notified, deadline passed |
| INC-403 | UK | 860 | 2 | Not notified, under 24 hours left |
What to do this week
- Notify the regulator on INC-401 now: its deadline has passed or is about to.
- Record why each late notification was late, for the regulator's follow-up.
- Start the clock at discovery for every new incident and set an alert at 24 hours before the deadline.
Do
- Fix the highest-risk item first, then run the check again on fresh data.
Don't
- Don't act on one row alone: open the source record first.
How to improve
- Add more detail per row (owner, date, source) so the next report can trace each item.
- Add a second period of data so the next report can show whether things are improving.
Demo
Overview
In the hours after an incident, disclosure obligations run on a clock. GDPR allows 72 hours from awareness; other regimes allow less, and contracts often allow less still. Deadlines are missed not from negligence but because the people who know the obligations are the same people containing the breach.
This agent takes the facts as they stand and drafts what has to go out: the regulator notification, the customer notice, the internal brief, and a holding statement for the questions that arrive before the facts are settled. It counts each deadline from the awareness time you give it and shows what remains.
It sends nothing. Every output is a draft for a named human to approve, and that limit is enforced by the agent's permissions rather than its instructions. It also refuses to characterise what happened beyond your stated facts — writing 'no evidence of misuse' before anyone has checked is how a notification becomes a second problem.
Benefits
Drafting removed from the critical hour
Responders contain the incident; the drafts are already waiting.
72h GDPR
Deadlines visible
The 72-hour clock counted rather than remembered.
Nothing overstated under pressure
The reassuring sentence nobody can yet support is never written.
What it does
Every audience, one pass
Regulator, affected customers, internal staff, and a holding statement.
Deadlines counted, not recalled
Each obligation counted from your stated awareness time, with time remaining.
Written to your facts only
No reassurance the facts do not support. What is unconfirmed is labelled unconfirmed.
Cannot send
Drafts only. The send is a human's, enforced by permissions rather than by instruction.
Flags what only counsel can decide
Liability, admission and regulator strategy are routed, never drafted around.
What this changes
What this changes about your week
- It takes over
- Working out who must be told, by when, under which regime.
- Done today by
- Counsel and the incident lead, at the worst possible moment.
- How often
- Rare, and it decides the outcome when it happens.
- Typical manual effort
- Establishing obligations across jurisdictions is hours you do not have.
Why Cybersecurity in particular. Deadlines run in hours, not days. This is the one agent whose value is entirely in the worst week of your year.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Incident Disclosure Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3ToolsNo external tools
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- The facts as known: what happened, when awareness began, what data and how many people
- Which regimes and contracts apply
- Requires the All-Access plan or higher
Use cases
Confirmed data incident
Produce the full notification set while containment continues.
Suspected but unconfirmed
Get a holding statement that commits to nothing prematurely.
Tabletop exercises
Rehearse the disclosure path before it is needed.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Can it notify the regulator directly?
No. It drafts; a person sends. Regulatory notification is a legal act with consequences for the organisation and its officers, and it is never automated here.
Is this legal advice?
No. It organises facts against commonly cited timelines and produces drafts for review. Every incident needs counsel; the agent says so in its output and flags what only counsel can decide.
Why will it not say 'no evidence of misuse'?
Because that is a finding, not a fact, and it is usually written before anyone has checked. If your investigation establishes it, supply it as a fact and the agent will use it.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent