The 03:12 emergency: one incident, four statutory clocks — every notification drafted in minutes
Ransomware hits a municipal utility. The moment the crisis team becomes aware, four deadlines start at once: 24 hours for the early warning to the BSI, 72 hours for the full notification, 72 hours for the parallel GDPR Art. 33 report to the supervisory authority, one month for the final report. Six agents produce all five documents ready for decision — every statement carrying its article and paragraph, every unconfirmed point marked unconfirmed. Filing and release stay human.