Worked example: the incident that started on a Tuesday

A lender uses a model to pre-screen loan applications. On a Tuesday afternoon an operations analyst notices that decline volumes for one product jumped on 3 September and have stayed high. It is now 17 September. She raises it with her team lead.

What is known, and what is not

Known: declines for the product roughly doubled from 3 September. Not known: why, whether any group is disproportionately affected, whether the model or an upstream data feed changed, and whether the affected applicants would have been approved otherwise.

The instinct is to investigate before escalating. Follow that instinct for a moment and see where it leads.

The clock that is already running

Awareness is the trigger. The honest reading here is that the organisation became aware on 17 September, when a person with responsibility for the process observed the anomaly and recognised it as one. Not on 3 September, when it began; nobody knew. Not on the day the classification is eventually made.

Now apply the deadlines to the possibilities. If this turns out to be a malfunction with no fundamental-rights dimension, it may not be a serious incident at all. If the model has been systematically declining applicants on a protected characteristic or a proxy for one, it falls within the Article 3(49) limb covering infringement of Union law protecting fundamental rights. And if it has run for two weeks across a whole product line, the question of whether it is a widespread infringement is live, which puts the deadline at 2 days from 17 September, not 15.

So the investigation that feels prudent consumes the entire deadline of the worst case before anyone knows whether the worst case applies.

What the pre-agreed table does

The lender has a severity table written six months earlier. It contains a row that reads, in substance: an unexplained shift in outcome rates affecting a whole product or customer segment, persisting more than 48 hours, is provisionally severity 1; it goes to the named accountable executive and the legal lead the same day; the default assumption is that the shortest applicable deadline applies until the classification is settled.

That row does three things on 17 September. It removes the need for the analyst to form a legal view. It makes the two-day assumption the default rather than something someone has to argue for. And it names who is on the hook, so the case does not sit in a queue.

The table was cheap to write because nobody knew what it would be applied to. That is precisely why it is credible now.

How the days are spent

Day 0, 17 September. The facts are logged: system, observable behaviour, date of onset, date of awareness, estimated affected population as a range, and that it is ongoing. The accountable executive decides to suspend automated declines for that product and route them to manual assessment. That is the stop function being used, and it also stops the affected population growing.

Day 1. Analysis establishes that an upstream field began arriving empty for applications from one channel, and the model treats an empty field as an adverse signal. The affected group is not defined by a protected characteristic, but the channel is used disproportionately by one, so the fundamental-rights question is not closed.

Day 2. The initial report goes to the authority on the widespread-infringement assumption, incomplete, stating what is known, what is not, and what has been done. Article 73 permits exactly this, and the complete report follows once the analysis is finished. The alternative, waiting until the analysis was complete on day nine, would have produced a better document and a late one.

The counterfactual

Without the table, the same organisation spends days 0 to 5 deciding whether this is really an incident, with the modelling team arguing it is a data quality issue and legal arguing it cannot advise without facts. Both positions are reasonable. The outcome is a report on day 9 against a deadline of day 2, and a regulator whose first question is when the organisation became aware. The answer to that question was determined on the Tuesday afternoon and cannot be improved afterwards.

As of 24 September 2026.