Regulation as Constraint: NIS 2, DORA, CRA, GDPR, the AI Act and the Reporting Clock

All courses / AI Blue / Module 4 / Chapter 19

Learning objectives

After the lesson the participant can:

• Map the instruments and articles the chapter names to what a blue team must be able to show for each
• Build an incident clock with two awareness timestamps, an owner and a deputy per clock and reasons for closing
• Explain what a management body may delegate and what it may not, as the chapter reads NIS 2 Article 20 and DORA Article 5
• Design the separation between the evidence view and the management view of an analyst action log

Key concepts

Reporting clock

The interval between the moment an organisation is regarded as aware of an incident and the moment each notification is due. One incident can open several clocks that start at different moments and have different owners.

Two awareness timestamps

The case system writes first_flag_at when a detection fires or a provider's page arrives and human_confirmed_at when a named analyst confirms. Clocks open at the earlier moment; whether a flag counts as awareness is for counsel and the supervisor.

NIS 2 Article 23 timings

As the chapter gives them: an early warning of a significant incident within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month.

Closed clock with reasons

A clock that does not apply is closed with the classification, the time and the name of the person. The closed clocks are part of the evidence.

Evidence view and management view

Incident roles and auditors see the action-level record of who did what. Management reports show aggregates only, by team and period, with no figure by name, and the purpose is written into the agreement and the tool.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The architecture should not try to settle whether an AI system's flag counts as awareness. What does it mean in practice to make the question answerable instead?
2. A management body cannot be accountable for what it cannot see. What would a quarterly report need to contain for your board to oversee the SOC's delegation?
3. The same log serves accountability under the regulations and must never become a score under the works agreement. Which design choice does most to keep the two apart?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. At which moment do the clocks open in the chapter's design?

   1. When the management body is informed at its next meeting
   2. At the earlier of the first flag and the human confirmation, by a rule of the case system
   3. When the investigation agent classifies the incident as major
   4. When legal counsel has decided what awareness means for the regime concerned
   Show the answer

   B. At the earlier of the first flag and the human confirmation, by a rule of the case system
   Opening is a deterministic rule of the case system, not an action of an AI agent, and due times are counted from the first flag so the record never claims more time than the conservative reading allows.

2. How does the book read the AI Act's Annex III in relation to AI used for security operations?

   1. Every triage and investigation agent is a prohibited practice
   2. All security AI is high-risk, because it is a safety component of critical infrastructure
   3. Security AI is outside the Act's definition of an AI system
   4. No listed use describes security operations, though the SOC's AI is an AI system under the Act
   Show the answer

   D. No listed use describes security operations, though the SOC's AI is an AI system under the Act
   As the book reads Annex III, no listed use describes security operations, but the SOC's AI is an AI system, with the organisation as provider or deployer, and Article 4 on AI literacy applies.

3. What is the AI ceiling for sending a notification to an authority, in the chapter's table across the degrees of delegation?

   1. Not delegated: a named person sends it, because the duty cannot be held by a system
   2. Level 3 Bounded, inside a playbook with a rate limit
   3. Level 2 Supervised, with approval by the duty analyst
   4. Level 1 Assisted, with the AI sending the notice once a named person has read the draft
   Show the answer

   A. Not delegated: a named person sends it, because the duty cannot be held by a system
   Sending is an AC-4 action and is not delegated. The AI drafts at Level 1 Assisted, citing the record, and a named person checks and sends.