CLAIM-2026-09-07-09
Measure 9.3 of Commitment 9 of the GPAI Code of Practice sets reporting deadlines from awareness of two days for critical-infrastructure disruption, five days for a serious cybersecurity breach, ten days for the death of a person and fifteen days for serious harm to health, fundamental rights, property or the environment, with reporting directed to the AI Office.
Why it matters
The tiers are concrete enough to check a real timeline against, and the reporting line matters more than the deadline: it runs upward, not outward.
Sources
- euaiactexpl2026code