AI Governance Engineer
GitHub

The overlapping incident clocks

First-report deadlines of eight regimes, timed from awareness: DORA at 4 hours after classification to the AI Act and SB 53 at 15 days, in one incident record.

By Updated First published

The overlapping incident clocks First-report deadlines of eight regimes, timed from awareness: DORA at 4 hours after classification to the AI Act and SB 53 at 15 days, in one incident record. From awareness; not to scale 0 4h 24h 2d 72h 5d 10d 15d DORA Art. 19 (4h after classification) NIS2 Art. 23 Cyber Resilience Act Art. 14 California SB 53 EU AI Act Art. 73 GPAI Code (Art. 55) GDPR Art. 33 New York RAISE Act (from 1 Jan 2027) Clocks run from awareness, except DORA's 4h (from classification), RAISE (from a determination) and SB 53 (from discovery). One incident record A timer per regime; alert on the nearest
The overlapping incident clocks The first-report deadlines that one event can start at once under eight regimes, on one axis from awareness, as of 2026-09-24. Hold every clock in one incident record and alert on the nearest deadline. Drawn from chapter 17.

Text alternative

One event can start several clocks. First reports, counted from awareness unless noted, as of 2026-09-24: DORA Art. 19, within 4 hours of classification as major and no later than 24 hours from awareness, or within 4 hours of a classification made after those 24 hours; NIS2 Art. 23, an early warning within 24 hours and a notification within 72 hours; the Cyber Resilience Act Art. 14, an early warning within 24 hours and a notification within 72 hours; California SB 53, within 15 days of discovery, or within 24 hours on an imminent risk of death or serious physical injury; EU AI Act Art. 73, no later than 2 days (widespread infringement or critical infrastructure), 10 days (death) or 15 days (other); the GPAI Code of Practice under Art. 55, 2, 5, 10 or 15 days depending on the harm; GDPR Art. 33, where feasible within 72 hours; the New York RAISE Act, within 72 hours of a determination, effective 1 Jan 2027. Follow-up and final reports, the deployer's duty under Art. 26(5), GDPR Art. 34 and the voluntary OECD framework are in the table. The engineering answer is one incident record that holds the facts once, with a timer per regime, and a pipeline that alerts on the nearest deadline.

Download

Every file carries the attribution band "aigovernanceengineer.com · CC BY 4.0 · v0.5.0" inside the image, and the version is in the file name, so a copy always says where it came from and which edition it shows. The SVGs keep the text live: the first follows the viewer's light or dark setting, the other two fix one theme for slides and print. The PNGs are drawn with the site's own typefaces.

First-report deadlines of eight regimes, timed from awareness: DORA at 4 hours after classification to the AI Act and SB 53 at 15 days, in one incident record.
The PNG, light, 1600 px wide, as it downloads (shown here as a lighter copy).

Reuse and credit

The figure is published under CC BY 4.0: you may copy, share and adapt it, commercially too, provided you give appropriate credit, link to the licence and say if you changed it. Keep the attribution band in the image. A credit line that covers title, author, source and licence:

“The overlapping incident clocks” by Jorge García Aibar, aigovernanceengineer.com (https://aigovernanceengineer.com/figures/incident-clocks), v0.5.0. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

Embed with HTML

<figure>
  <img src="https://aigovernanceengineer.com/downloads/figures/incident-clocks-v0.5.0-light-1600.png" alt="First-report deadlines of eight regimes, timed from awareness: DORA at 4 hours after classification to the AI Act and SB 53 at 15 days, in one incident record." width="800" height="1133" loading="lazy">
  <figcaption>
    <a href="https://aigovernanceengineer.com/figures/incident-clocks">The overlapping incident clocks</a> by Jorge García Aibar,
    aigovernanceengineer.com, v0.5.0.
    Licensed under <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>.
  </figcaption>
</figure>

Embed with Markdown

![First-report deadlines of eight regimes, timed from awareness: DORA at 4 hours after classification to the AI Act and SB 53 at 15 days, in one incident record.](https://aigovernanceengineer.com/downloads/figures/incident-clocks-v0.5.0-light-1600.png)

*[The overlapping incident clocks](https://aigovernanceengineer.com/figures/incident-clocks) by Jorge García Aibar, aigovernanceengineer.com, v0.5.0. Licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).*