Mandatory reporting in the digital age: how AI speeds up NIS2 and GDPR notifications

Why reporting duties are difficult under time pressure

In the first hours of a crisis, information is scarce, fragmented and often still unconfirmed. At the same time an organisation has to file a formal notification within a limited number of hours that meets specific requirements: which systems or data are affected, when the incident was discovered, what the first assessment of impact is, and which measures have already been taken. Gathering those facts and casting them in the right form takes time, precisely when there is least of it.

That bottleneck is felt even more when crisis management and legal handling are organised separately: one group works on containing the incident, the other on drafting the formal notification, while both depend on the same, still incomplete facts. Every addition or correction then has to be worked back into the draft, which is error-prone when done by hand under time pressure. The person writing the text often has to help contain the incident at the same time.

GDPR and NIS2 in short: the clock starts on discovery

Under the GDPR, a personal data breach posing a risk to the rights and freedoms of individuals must in principle be notified to the Dutch Data Protection Authority without undue delay and at the latest within 72 hours of becoming aware of it. For a significant cyber incident the rhythm is tighter: an early warning within 24 hours of becoming aware, followed by a fuller notification within 72 hours and a final report within one month. That rhythm comes from the European NIS2 Directive and is laid down in the Netherlands in the Cybersecurity Act, in force since 15 August 2026. Notifications are filed through the central reporting point MijnNCSC, from where they pass to both the sectoral CSIRT and the supervisory authority.

Both deadlines start running at the moment of discovery, not at the moment the organisation fully understands the incident. That means a notification often has to be drafted while the investigation is still running and the picture can still change. For organisations falling under both regimes, for instance a provider of essential services that also processes personal data, both clocks can run simultaneously after one and the same incident. That calls for a process capable of preparing several notifications at once, each with its own required structure and its own supervisory authority.

Where AI can speed things up: from facts to a draft notification

The heart of the problem is not the assessment of whether something is notifiable — that is a legal judgement — but drafting the notification itself: gathering facts, answering the right questions, and putting that into the prescribed structure. This is exactly the kind of task where AI can support. If the timeline of the incident, the systems and people involved and a first impact assessment have already been recorded, for instance in a crisis management system, AI can generate a draft notification from them that already follows the required structure.

Think of automatically summarising a timeline from recorded team notes, laying out clearly which systems or data categories are involved, and formulating a first factual description of the measures already taken. Because the structure of a notification is fixed, a language model can hold to that structure consistently, even while the underlying facts are still being supplemented during the incident. The crisis team therefore does not start from a blank page, but can check, supplement and sharpen a draft. That saves valuable time in the first, busiest hours, and reduces the risk of a notification going out incomplete because steps were skipped under pressure.

What AI does not take over: the assessment and the accountability

Speeding up the drafting is something different from taking over the decision. Whether an incident is genuinely notifiable, and what exactly must appear in the notification, remains a judgement that belongs with a person: usually the data protection officer, a lawyer, or the crisis coordinator. They weigh the nature of the incident and the risks to individuals in a context a language model cannot survey.

A language model recognises patterns in language, not the legal nuances of a specific case. It cannot independently establish, for instance, whether a risk to individuals is high enough that they must also be informed directly, or whether an incident counts as significant under the NIS2 Directive. AI-generated text can also contain factual errors, certainly when the underlying facts are still incomplete. Every draft notification must therefore be read carefully and approved before sending by a person carrying final accountability. That matches the broader line applying to AI use under the EU AI Act in a crisis or emergency response context, and to the risks of AI hallucinations: AI supports, a person decides and signs.

Sources

• Dutch National Cyber Security Centre, reporting duties under the Cybersecurity Act — early warning within 24 hours, full notification within 72 hours, final report within one month, filed through MijnNCSC. Act in force since 15 August 2026. Accessed 22 September 2026.
• Articles 33 and 34 of the General Data Protection Regulation — notification to the supervisory authority and to data subjects.
• Directive (EU) 2022/2555 (NIS2) — Article 23 on reporting obligations.