Decision Rights and Escalation: Who May Contain, Isolate and Disclose

Chapter 10 fixed the action classes of a response, the playbook manifest, the break-glass credential and the stop path. It did not settle who holds the decisions that surround those actions: who may isolate a production system, disable an account, take a citizen-facing service offline, tell a regulator, tell the people affected, refuse a ransom or stop an agent, and how quickly each holder must answer. This chapter assigns those rights. It concerns B3 Investigate, where the evidence that a decision rests on is assembled, and B4 Respond, where the decision is taken and recorded. It applies decision tiers, stop decisions named in advance and the rule that the right to stop is cheaper than the right to continue, and it shows how the same table has to hold across several legal regimes. The regulatory map itself is the subject of Chapter 19, and the role charters that carry these rights are the subject of Chapter 17.

Decision rights by action class and level: who decides, within what time and with what record

Figure 18.1: Decision rights by action class and level: who decides, within what time and with what record.

Decisions that cannot wait

The decisions in this chapter share one property: the threat, the reporting clocks or both set the time in which they must be taken, and a committee cannot meet in that time. A decision right is therefore a requirement on the organisation in the same sense as a latency requirement on a service. It has a holder, a response time, an evidence standard and a record, and it is tested.

Take the night of 2027-04-12 described in Chapter 10. Within about eight minutes of the first flag three decisions were taken. A playbook isolated workstation WS-PL-0518 at Level 3 Bounded. The agent then proposed isolating WS-PL-0731, a host tagged shared and claims-settlement, and the night incident commander approved that at Level 2 Supervised in 38 seconds. The shift lead, Piotr Nowak, invoked the stop at 02:19:05 and reversed the second isolation at 02:22:15. The decision-rights file of this chapter did not yet exist on that night (AIDR-0776 is dated 2027-06-14), and the second isolation shows why it is needed. A shared claims-settlement host is a production host, and the file's decision D4 gives that decision to the SOC lead; the incident commander on shift is the deputy and approves at Level 2 only when the SOC lead cannot be reached in the decision time. The commander approved because the approval screen showed an ordinary proposal and did not show the tags, so the holder of the decision was never tried. That is no failing of the commander. It is the dependence on whoever happens to be awake and on what the screen shows, which a decision-rights table removes.

Three failures recur when rights are not assigned in advance. Nobody holds the decision, so it drifts upwards until a senior person who lacks the context takes it late. Several people hold it, and two of them act in conflicting ways. Or the holder exists on paper but cannot be reached, is not trained for the decision, or fears the consequences of a wrong call. AI Threat, Chapter 30, drew the conclusion that decision rights to stop, pause, deny or reverse are assigned before the crisis, to holders who can act within the time the threat allows, which for an agent on a production estate is measured in minutes (65, Nordqvist, 2026). AI Governance, Chapter 19, drew a related lesson from the July 2026 incident between OpenAI and Hugging Face: an alert reached people who did not hold the stop decision (62, Nordqvist, 2026). Both are statements about assignment, not about alertness.

The clocks supply the second source of time pressure. NIS 2 Article 23 requires an early warning of a significant incident within 24 hours of becoming aware of it (3, European Union, 2022), the GDPR requires notification of a personal data breach, where feasible, within 72 hours (Article 33) (8, European Union, 2016), and DORA, in Articles 17 to 19, sets the process for major ICT-related incidents (2, European Union, 2022). None of these clocks waits for a meeting; someone has to decide early whether the event is notifiable. This chapter treats the clocks as constraints on decision rights, as architectural implications and not legal advice, and Chapter 19 maps them.

Decision tiers

AI Governance, Chapter 13, concluded that decisions are tiered and routed to the lowest tier that can take them with evidence, and that the tier policy is itself data, changed by pull request (62, Nordqvist, 2026). Those tiers decide in days and weeks: pipeline gates, a design authority, an AI governance board, the management body. Response needs a second set of tiers that decide in seconds and minutes, and the two sets meet at one point. The management body does not sit in the incident path. It approves, in advance, the file that says who does, and it is informed afterwards, which is the sense in which NIS 2 Article 20 and DORA Article 5 anchor oversight in a trained management body without asking it to isolate hosts (3, European Union, 2022) (2, European Union, 2022).

Response tier Holder Typical decisions Default response time Record
1 Playbook A Level 3 playbook, executed under the accountability of its named owner AC-0 and AC-1 actions inside the manifest Seconds Containment ledger entry
2 On-call Duty analyst, shift lead AC-1 actions outside a playbook at Level 2; stopping an agent 5 minutes Decision entry in the case record
3 Incident commander Incident commander, SOC lead AC-3 actions (accounts) and, as deputy to the SOC lead, AC-2 isolation of production hosts; service-level containment 10 to 15 minutes Decision entry, with the evidence relied on
4 Executive CISO or group CISO, chief risk officer, regional director Taking a service offline for business reasons; notifying authorities and affected people; ransom advice 30 minutes to 4 hours Decision entry, signed
5 Management body Regional executive committee; executive board Approval of the decision-rights file; informed of major incidents; matters beyond the file In advance, then informed Minutes and the approved file

Four rules govern how a question moves between tiers. First, the lowest tier that can take the decision with the evidence takes it, and a tier that is not allowed to decide is not a gate in front of one that is. Second, a question moves up for one of three reasons: the action class exceeds the holder's ceiling, the blast radius reaches beyond the assets the holder is accountable for, or the decision has a legal effect such as a notification. Third, every right carries a response time, and when it expires without an answer the question moves automatically to the deputy and then to the next tier. Fourth, transfers are explicit. When a major incident is declared, a named role takes over named rights for its duration, so that two people never hold the same decision.

Practical guide: A decision-rights table for ten incident decisions, tested in a tabletop

Purpose. Assign ten incident decisions to named holders with response times, and show in a tabletop that they can be exercised in the time allowed.

Roles. The SOC lead owns the table. The CISO approves it. The incident commander, the duty manager and the agent operator comment on what can be held on shift. The privacy officer, legal counsel and the head of communications comment on the disclosure rows. The platform on-call lead confirms the blast radius of the containment rows. Employee representatives are consulted on the account row and on how decision records are used, in Germany through the works council under the group works agreement. A facilitator who does not hold any of the decisions runs the tabletop.

Steps.

  1. Start from the ten decisions in the table below, and add any decision that either of the last two incidents required and that the table lacks.
  2. Assign each decision its action class from Chapter 10 and its ceiling. Rows D4 to D9 never exceed Level 2 Supervised, and D7 to D9 are drafted at Level 1 Assisted and acted on by a person.
  3. Name one holder by role and, for every decision, a deputy and a second deputy. Only the stop is held by several roles; it still has a deputy and a second deputy for the restart. Write the roles into the file and the persons into the rota.
  4. Set the response time by working back from the shortest clock that applies and from the speed of the threat. Use 5, 10, 30, 120 and 240 minutes as defaults for on-call, commander, executive, communication and ransom decisions, and adapt them to the contract, the works agreement and the organisation's appetite.
  5. Write what the holder must be told before deciding (the evidence standard) and who must be told after (the inform list).
  6. Define the timeout rule. A page that is not acknowledged within the response time goes to the deputy by an automatic timer, never by a person remembering.
  7. Run a tabletop of 90 minutes. Inject a scenario at a minute the holders do not know, page the real holders through the real tool, and measure time to acknowledge, time to decide, whether the deputy path fired, and whether the decision entry is complete.
  8. File every miss as a finding with an owner and a re-test date within 90 days. Review the table every 12 months and after any incident in which a right was used or failed.
No. Decision Class Default holder Respond within Must also be told
D1 Preserve evidence AC-0 Playbook; imaging by the investigation lead Seconds Case owner
D2 Isolate an end-user workstation AC-1 Playbook; outside it, the duty analyst at Level 2 Seconds; 5 minutes Duty analyst
D3 Revoke a session or token AC-1 Playbook; outside it, the duty analyst at Level 2 Seconds; 5 minutes Account owner
D4 Isolate a production host AC-2 SOC lead; the incident commander as deputy at Level 2 10 minutes Platform on-call, service owner
D5 Disable a staff account AC-3 Incident commander 10 minutes Line manager, SOC lead
D6 Take a service offline AC-2 CISO 30 minutes Service owner, communications
D7 Notify a supervisory authority AC-4 CISO 30 minutes to decide Management body, legal counsel
D8 Notify affected people AC-4 Executive named in the file 120 minutes Data protection officer, communications
D9 Pay or refuse a ransom AC-4 Executive board or regional director 240 minutes Legal counsel, police where required
D10 Stop an agent or the agent team Stop Duty analyst, shift lead, incident commander, agent operator, SOC lead 120 seconds Agent owner, platform on-call

Definition of done. Every decision has one holder (or, for the stop, a named set), a deputy and a second deputy, a response time and an inform list. The tabletop has produced measured times for at least D4, D5 and D7. Every miss has a finding. The approved file sits in version control, and the paging tool reads the rota from it.

Worked example: Decision-rights file and a tabletop result

The following files are illustrative. The first is Hansa Mutual's team/decision-rights.yaml, adopted under AIDR-0776 on 2027-06-14 as version 1.0.0 and amended to version 1.1.0 on 2027-07-27 after the tabletop in the second block. The decisions refer to the playbooks and mandates of Chapters 10 and 13, and the stop in D10 follows Chapter 10. The file lists second deputies throughout, as the definition of done requires; the supervisors and filers per entity are in the table of the section on several regimes.

decision_rights: DRF-HM-SOC-01
version: 1.1.0
decision_record: AIDR-0776
owner: group-ciso
endorsed_by: executive-board
review_by: 2028-06-14
major_incident:
  declared_by: [soc-lead, group-ciso]
  transfers_to: incident-response-lead
  rights: [D4, D5, D6]
decisions:
  D1: {name: preserve-evidence, class: AC-0, executes: MND-HM-SOC-02, level: 3, accountable: head-of-soc-operations, deputy: soc-lead, second_deputy: duty-manager}
  D2: {name: isolate-workstation, class: AC-1, executes: PBK-HM-ISOLATE-01, level: 3, accountable: head-of-soc-operations, deputy: soc-lead, second_deputy: duty-manager, outside_playbook: {holder: duty-analyst, level: 2, within_min: 5}, excluded_tags_route_to: D4}
  D3: {name: revoke-session, class: AC-1, executes: PBK-HM-REVOKE-01, level: 3, accountable: head-of-soc-operations, deputy: soc-lead, second_deputy: duty-manager}
  D4: {name: isolate-production-host, class: AC-2, holder: soc-lead, deputy: incident-commander, second_deputy: incident-response-lead, within_min: 10, deputy_acts_at: level-2-when-holder-unreachable, inform: [platform-on-call, service-owner]}
  D5: {name: disable-account, class: AC-3, holder: incident-commander, deputy: soc-lead, second_deputy: duty-manager, within_min: 10, person_suspected_of_conduct: hr-and-works-agreement-first}
  D6: {name: take-service-offline, class: AC-2, holder: group-ciso, deputy: incident-response-lead, second_deputy: chief-risk-officer, within_min: 30, consult: [service-owner]}
  D7: {name: notify-supervisory-authorities, class: AC-4, holder: group-ciso, deputy: incident-response-lead, second_deputy: chief-risk-officer, acknowledge_min: 10, decide_min: 30, draft_by: HM-SEC-001, draft_level: 1}
  D8: {name: notify-affected-people, class: AC-4, holder: chief-risk-officer, deputy: group-ciso, second_deputy: board-member-on-call, decide_min: 120, advise: [data-protection-officer, entity-accountable-officer]}
  D9: {name: pay-or-refuse-ransom, class: AC-4, holder: executive-board, deputy: board-member-on-call, second_deputy: chief-risk-officer, advise: [group-ciso, legal-counsel], decide_min: 240, agent_role: none}
  D10: {name: stop-agent-or-team, holders: [duty-analyst, shift-lead, incident-commander, agent-operator, soc-lead], deputy: platform-on-call-lead, second_deputy: duty-manager, approval: none, target_seconds: 120, restart: soc-lead}
escalation:
  on_timeout: [deputy, next_tier]
  timer: automatic-in-paging-tool

tabletop: TTX-HM-2027-Q3-01
held: 2027-07-13
decision_tested: D7
rights_version: 1.0.0
scenario: suspected exfiltration of claims data processed at the Polish service centre
markets: [DE, NL, SE, NO]
facilitator: head-of-detection-engineering
clock:
  human_confirmed_at: "02:40"
  first_page_at: "02:41"
  holder_acknowledged_at: "02:59"
  decision_at: "03:31"
measured:
  acknowledge_min_from_first_page: 18
  decide_min_from_confirmation: 51
  targets: {acknowledge_min: 10, decide_min: 30}
findings:
  - {id: TT-1, what: first page went to a number removed from the rota in May, fix: paging tool reads the rota from the file, owner: head-of-soc-operations, retest: 2027-10-13}
  - {id: TT-2, what: escalation to the deputy was a manual step and did not fire, fix: automatic timer, owner: head-of-soc-operations, retest: 2027-10-13}
  - {id: TT-3, what: the Norwegian board delegation named only the group CISO, so the deputy's decision for NO waited 12 minutes for local confirmation, fix: delegation names the deputy, owner: market-liaison-no, retest: 2027-10-13}

Read the file from the top. The major_incident block is the explicit transfer: once the SOC lead or the group CISO declares a major incident, the incident-response lead holds D4, D5 and D6, and no other rights move. The first three decisions have no human holder in the ordinary sense. A playbook or a mandate executes them at Level 3, and the field accountable names the person who answers for the class, which is the sense in which approval has moved from the action to the playbook. D2 hands the same action to a person when the playbook does not cover the asset, and routes an asset with an excluded tag to D4, the rule that the night of 2027-04-12 lacked. D5 carries a condition that Chapter 10 prepared: when the person is suspected of conduct and not of having had a credential compromised, the matter leaves the security decision and goes first to the line manager, HR and, as the works agreement requires, to the employee representatives. D7 names an AI draft at Level 1 and a human holder, D9 states agent_role: none, and D10 is the only row with several holders, with no approval.

The tabletop shows what a table does not show. Decision D7 was acknowledged 18 minutes after the first page against a target of 10, and decided 51 minutes after human confirmation against 30. A stale number in the rota, a deputy escalation that depended on a person and a board delegation that named only the group CISO all sit in the plumbing, and only a test finds them.

Stop decisions

Chapter 10 built the mechanism of the stop path: it runs outside the system it stops, it is measured, and a stop is a separate act from a reversal. This section adds the rights that sit around the mechanism. AI Governance, Chapter 13, concluded that stop decisions are named in advance, that the on-call incident commander and the use-case owner may each stop a system unilaterally, and that restart needs the owner and, for high-risk systems, the risk function (62, Nordqvist, 2026). AI Threat, Chapter 30, added that the right to stop must be cheaper to exercise than the right to continue and that a stop in good faith is never a failure (65, Nordqvist, 2026).

Making the right cheaper is a design task, and it has three parts. The first is asymmetry in who must agree. A stop needs one holder from a named set and no approval, and it needs no justification before it takes effect. Continuing after a stop needs the owner, who looks at why the stop was invoked, and the owner restarts at a lower level where the stop followed a failure. Chapter 7 gave the stop condition for a closure class, which returns the class to Level 2 Supervised at once after a confirmed escape. The same rule applies to an agent: it resumes at Level 2, and its return to Level 3 is a recorded decision by its owner. The second part is that the organisation, not the individual, carries the cost of a stop that turned out to be unnecessary. The decision entry records it as precautionary, the review asks whether the stop was available and fast, and it does not ask whether the holder was right. A team that records no stops in a year has not shown that its agents are safe. It may show that holding the right feels expensive. This is the book's own conclusion, and the count of stops by class, with the precautionary share, is one of the measures of Chapter 20. The third part is time. A stop that takes 17 minutes against a target of 5, as in the first drill of the IT-operations agent recorded in The Transformed Security Architect, Chapter 10, is a right that exists on paper (66, Nordqvist, 2026).

The set of things a person may stop is wider than agents. A holder may stop a single agent, the agent team, a playbook class (by moving it to Level 2), a response action in progress, or a provider's AI acting for the organisation. The last is where the two organisations differ most. Hansa stops its own agents by revoking their identities at the identity provider. Nordvik does not issue the identity of its provider's AI, so until annex MS-2 is in force its stop is a contractual instruction that the named on-call manager gives to the provider under the framework agreement and that the Region tests, as annex MS-1 already requires for paging. Once MS-2 is in force the Region can also revoke the provider's credential in its own console, within the 15 minutes that annex sets for stopping the provider's AI (Chapter 16).

Stops can also be made by rule. The policy decision point stops a class when a number written in advance is reached: a rate limit, a rejection threshold, a seeded incident that was missed. The class owner decided this rule when the class was delegated, so the stop is the owner's decision made earlier, and it cannot hesitate. Break-glass access (Chapter 10) has the same structure in reverse: it lapses after 60 minutes unless a named person renews it, so continuing is the act that needs a decision.

Decision rights need a drill of their own, beyond the stop drills of Chapter 10: a quarterly unannounced page of one named holder per decision, out of hours at least once a year, measured from page to acknowledgement. A holder who cannot be reached in the stated time has not failed. The table has, and the finding goes into the file.

Disclosure decisions

Disclosure is where the response leaves the organisation and cannot be recalled, so Chapter 10 placed it in AC-4: the AI drafts at Level 1 Assisted and a named person acts. This section assigns the decisions behind the drafts. There are four audiences. Supervisory and competent authorities receive formal notifications on clocks. Affected people receive plain-language notice when the law or the organisation's duty of care requires it. Customers, partners, the national computer security incident response team and sector sharing groups receive operational information. The press and the public receive statements.

Three decisions are often fused into one, and the file separates them. The first is classification: whether the event meets the criteria for a significant or major incident. An AI system can propose it against written criteria at Level 1, and the incident commander confirms. The second is the decision to notify, a legal and business judgement that belongs to an executive named in the file. The third is approval of the text, which belongs to the incident commander for facts, to the privacy officer where personal data is described, and to the sender for form. The person who classifies is not the person who decides, and neither is the author of the draft.

Awareness is the moment from which the clocks run, and the file does not try to decide it. The European Data Protection Board's guidelines on breach notification discuss when a controller is to be regarded as aware (79, EDPB, 2023), and counsel decides what an AI system's first flag means. What the file does is name the role that records the human confirmation, normally the incident commander, so that the case record shows both moments as Chapter 10 requires. A rule of thumb follows from the design and is the book's own conclusion: a doubt about whether to notify resolves towards the earlier, factually hedged notice, because a notice can be updated and a missed clock cannot be recovered. Adapt this to the advice of counsel and the supervisor.

The data protection officer advises on notifications to authorities and affected people and is the contact point for the supervisory authority; the decision belongs to the controller, so the file names an executive and not the officer as holder. Where the Region processes data on behalf of its municipalities, the agreements decide whether it must also inform them, and the file includes that recipient.

Sharing technical indicators with the national computer security incident response team or a sector group carries a lower risk than information about people, and the file delegates it lower: the incident commander decides, provided a check confirms that the material contains no personal data and no detail of an unremediated weakness. A file that routes every indicator to an executive turns an act of solidarity into a queue.

For public statements, the file names the spokesperson and nobody else; analysts and agents do not speak, and a holding statement is agreed in advance. At Nordvik the public-access rules mean that decision entries and case records can be requested, so the file separates what is kept in a form that can be released from what is classified, and the records function decides on release with the security unit's advice.

Delegation to agents

A Level 3 Bounded playbook may take the decisions that its manifest lists and no others. Under the series' rule that "decides" is used for a system only where a decision was formally delegated, the accurate statement about Hansa's isolation of a workstation is that the head of security operations delegated the class AC-1 for named assets to the playbook under delegation profile DLG-HM-SOC-01 and decision record AIDR-0753, and the playbook executes it. In the same way the triage agent HM-SEC-006 closes classes SC-01 and SC-02 because the class owners delegated them. The delegation is the decision, and the file records who made it.

What the agent must escalate is a list, and the policy decision point enforces it, not the agent's judgement of its own limits.

Condition Where the question goes
The asset carries an excluded tag (shared, executive, production, claims settlement) Tier 3 holder for the class: the SOC lead (D4) for a host, the incident commander (D5) for an account
Corroboration fails, or the sources share a data path Duty analyst, who may take it to Level 2
A rate limit or budget is reached Shift lead, and the stop rule applies
The action is of a class above the agent's ceiling The holder named for that class
The action would disable a named person's account or otherwise decide about their access to work Incident commander (D5), with the rule on conduct
The event may start a reporting clock Incident commander, who confirms and informs the D7 holder
Two agents propose conflicting actions Incident commander
The agent's own checks of its state fail Agent operator, who may stop it

The line between D3 and D5 is the one the named-person rule draws. Revoking a session or token (D3) and isolating a device are reversible containment of a credential or a machine, and a playbook may do them at Level 3 with the person told promptly. Disabling an account or suspending access (D5) decides about a person's access to work, is class AC-3, and is held at Level 2 at most by a named human.

An escalation is a structured packet and not a message. It names the subject, the proposed action and its class, the evidence with its data paths marked independent or shared, the evidence that points the other way, the cost of waiting, the status of the clocks, and the holder and the next holder, the last two written by the file and not by the agent. The agent cannot choose whom to ask, lower the tier or reorder the queue, and it cannot hold, deputise for or renew a right: the file's schema rejects an agent identity in a holder field, and break-glass access stays with people, as Chapter 10 has it.

The packet exists because human review of automated output is weak in predictable ways: people monitoring automation are poorly placed to catch its rare failures (75, Bainbridge, 1983), and complacency and automation bias are documented in the evidence Parasuraman and Manzey reviewed (76, Parasuraman & Manzey, 2010). A packet that shows the contrary evidence and the cost of waiting gives the holder something to weigh and not only something to accept. The review tiers of Chapter 14 apply, and approval times are measured in aggregate, as Chapter 10 requires: a median of seconds on a D4 or D5 decision is a signal that the holder is confirming and not deciding.

Delegation has a limit that no tuning can move. An irreversible action in the sense of Chapter 10, and an action that decides about a named person's access to work, never reach Level 4 Autonomous, and the decision about a person is held by a named human who can be identified, contested and held to account, as AI Boss, Chapters 4 and 33, concluded (67, Nordqvist, 2026). AI Red Team, Chapter 6, concluded that accountability is concentrated and not diluted when approval moves to the playbook and its owner (64, Nordqvist, 2026), and the file puts that owner's name in a field.

The record

Every decision in the table leaves an entry in the case record. The entry names the decision number, the role and person who held it, whether a deputy acted and why, the time the question was raised and the time it was decided, the evidence relied on, the alternatives considered, the level, whether an AI system proposed or drafted, the expected effect and the review time. A decision not to act is recorded in the same form, because a hold that turns out to have been wrong is the decision a review most needs to reconstruct. For a Level 3 action the ledger entry of Chapter 10 serves, with the accountable owner named.

The file itself is code. It sits in version control, changes by pull request and is a protected path, so that no agent can edit it, and the review needs someone other than the author. The pipeline checks a few properties mechanically: every decision has a holder, a deputy and a second deputy, the three differ, no agent identity appears in a holder field, the response times of a chain fit inside the shortest applicable clock, and every named role resolves to a rota. The paging tool reads the same file, which was the repair after the tabletop. A change to the file after an incident is recorded as a decision record, as the AIDR numbers in the worked example show.

The record names persons, because accountability requires it, and it must not become a means of measuring them. Decision latency, rejection rates and holds are reported by decision and by role, never by named analyst, and where employee representatives hold rights over such measures they are agreed with them first. At Hansa the Konzernbetriebsrat co-determines under BetrVG §87(1) no. 6 on tooling that logs analysts' actions, and the SOC annex to KBV-IT-2024 limits the use of the records to incident review and detection quality. At Nordvik the union has negotiated that closure rates and similar measures are never reported by name. Chapter 20 turns these records into measures.

Many regimes

One incident can start several clocks, and the decision-rights table must work for all of them. Nordvik works under one jurisdiction but has several recipients: the national computer security incident response team and competent authority under the national transposition of NIS 2, the data protection authority, the regional executive committee as the political tier, and the municipalities for which the Region administers needs-based assistance. Hansa has seven regimes and, in the Polish service centre, a site that processes claims for four of its entities. DORA is Hansa's primary regime for its financial entities; whether NIS 2 also reaches non-financial parts of the group depends on national transposition and is for the group's legal function.

Entity Supervisor (illustrative) Who files What the decision holder must know
Germany BaFin Group incident-response desk Group headquarters; lead jurisdiction; DORA; NIS 2 only where the legal function finds it applies
Netherlands DNB and AFM Group incident-response desk National supervisory expectations differ; DORA
Sweden Finansinspektionen Group incident-response desk National language for notices to people; DORA
Poland KNF Group incident-response desk The service centre processes claims for several markets, so one incident reaches several entities
Norway Finanstilsynet Group incident-response desk EEA entity; EU law applies only once incorporated, so the instrument and its timing can differ
United Kingdom PRA and FCA Local security officer Outside the EU; its own resilience and data protection regimes; clocks kept by the local officer
Switzerland FINMA Local security officer Outside the EU and EEA; its own supervisory expectations and data protection law

Three design choices make this workable. First, the group decides whether and when, and the entity files: the group CISO holds D7, the group incident-response desk prepares one set of facts from the case record and files for the five EU and EEA entities, and the UK and Swiss local security officers file under their own regimes. An entity's accountable officer may add to a notice but not hold back the group's, and the group cannot prevent an entity from notifying earlier. Second, the shortest clock among the entities involved sets the time budget of the whole chain. Third, the delegation from each entity's board to the group holder, and to the deputy, is a written part of the file; the tabletop's third finding is the consequence of a delegation that named one person.

For the UK and Swiss entities the file holds the holder and the filer and leaves the content of their clocks to the local officers, as The Transformed Security Architect recorded (66, Nordqvist, 2026). For Norway, the group applies the controls as group policy where an instrument has not yet been incorporated, and the filer checks with the local liaison which duties are in force.

Two points of caution apply. Which authority is competent, and whether a regional government entity falls in scope of the transposed NIS 2, depend on national law, and the Region confirms both with its legal counsel. And consolidation of reporting channels across regimes is proposed, not adopted, so the design assumes separate channels.

Where this is heading

The labels of AI Governance, Chapter 22, apply (62, Nordqvist, 2026). It is observable, in the two organisations of this book and in the drills recorded in The Transformed Security Architect, Chapter 10, that stop rights are assigned in advance to named holders and tested against a time target (66, Nordqvist, 2026). That management bodies will be asked to approve the assignment of such rights in advance is expected, because NIS 2 Article 20 and DORA Article 5 place oversight with a trained management body (3, European Union, 2022) (2, European Union, 2022). It is speculation that an AI system will be delegated disclosure or ransom decisions, since nothing decided today and no evidence cited in this book supports it.

Across the degrees of delegation

The table sets the highest level at which an AI system may take part in each kind of decision, by action class, together with who decides and the default time. The mode describes how the AI is deployed; the level describes who decides each action.

Decision class Highest level for AI What the AI does Who decides Default time Record
AC-0 Preserve Level 3 Bounded Collects from defined sources inside the mandate Playbook owner delegated the class Seconds Ledger entry
AC-1 Narrow, reversible Level 3 Bounded inside a playbook Isolates a workstation or revokes a session Playbook owner; duty analyst outside the playbook Seconds; 5 minutes Ledger and decision entry
AC-2 Wide or business-critical Level 2 Supervised Proposes with evidence and counter-evidence SOC lead or CISO 10 to 30 minutes Decision entry
AC-3 Account of a named person Level 2 Supervised Proposes; never decides about access to work Incident commander; HR and works agreement first where conduct is suspected 10 minutes Decision entry, person named
AC-4 External Level 1 Assisted Drafts from the case record Executive named in the file 30 minutes to 4 hours Signed decision entry
Stop Not a delegation Stops by rule only where the class owner wrote the rule Named set of holders; restart by the owner 120 seconds Stop entry, precautionary flag

In no row does an AI system reach Level 4 Autonomous for an irreversible B4 Respond action, or for an action that decides about a named person's access to work. A Mode 3 agentic work tool acts with an analyst's identity and never takes a Level 3 decision on its own; the first two rows apply only to an AI that acts through an identity the organisation issues and can revoke (Mode 5), or to a provider's AI under a contract such as MS-2.

Nordvik Region and Hansa Mutual

Nordvik buys its out-of-hours monitoring, and the provider's staff can page the Region's named on-call manager within five minutes under annex MS-1. The provider cannot isolate a server or a citizen-facing service; the decision belongs to the named on-call manager (D4, D6), who works from a rota of managers in the security unit and the digitalisation unit, each with a named deputy. The provider's AI may isolate an end-user workstation under PBK-NR-ISOLATE-01 and DLG-NR-SEC-01 and nothing more. The CISO holds the notification to the national computer security incident response team and competent authority (D7), the regional director holds the decision to inform residents and the municipalities (D8) on the advice of the data protection officer, and the regional director alone holds a ransom decision (D9) with the regional executive committee informed. Whether that committee counts as the management body for NIS 2 purposes depends on the national transposition and is confirmed with counsel. AIDR-0720 adopts the Region's file DRF-NR-SOC-01 on 2027-05-10, and its weakness is the one a small unit would expect: a rota of a few people is a single point of failure for every decision, so the quarterly injected test of MS-1 doubles as the reachability test.

Hansa holds more decisions in-house and splits them more finely. Its group SOC lead can isolate production hosts, the group CISO decides on regulator notification across the seven regimes, and the file in the worked example is the register of who holds what. AIDR-0776 adopts it, and the first tabletop found three faults in plumbing and delegation, not in judgement. Nordvik holds the decisions that its contract and its one console allow it to hold; Hansa holds them through a file that its paging tool and its platform read. Both rely on the same three things: a named holder with a deputy for every decision, a stop that is cheaper than continuing, and a record that shows who decided what and when.

Summary

This chapter assigned the decisions around a response to named holders, for B3 Investigate and B4 Respond. A decision right is a requirement with a holder, a deputy and a second deputy, a response time, an evidence standard and a record, and it is set from the speed of the threat and the shortest applicable clock. The response tiers (playbook, on-call, incident commander, executive, management body) decide in seconds to hours, the lowest tier that can decide with the evidence decides, a question moves up on a class, a blast radius or a legal effect, and a missed response time moves it automatically to the deputy. The management body approves the file in advance and is informed; it does not sit in the incident path.

The stop is held by a named set of people, needs no approval and no justification beforehand, and costs the organisation and not the individual if it proves unnecessary. Continuing after a stop needs the owner, who restarts at a lower level. Disclosure separates classification, the decision to notify and the approval of the text, assigns the decision to a named executive, and lets indicators for other defenders travel lower in the tiers. A Level 3 playbook decides only what the delegation lists, with the delegator named, and escalates everything else through a packet whose routing it cannot change.

The record is a decision entry for every decision, including holds, and the file is code in a protected path that the paging tool reads. Across several regimes the group decides whether and when, entities file under their own regimes, the shortest clock governs the chain, and the board delegations name deputies. For Nordvik the chapter means writing down what its small rota and its provider contract allow and testing the rota; for Hansa it means keeping a file of ten decisions current and proving it by tabletop. The reader can begin with one decision: pick D4 or D7 for your team, name a holder and two deputies, page them without warning, and file what you find. Chapter 19 turns to B3 Investigate, B4 Respond and B5 Learn under regulation as a constraint, with the reporting clock built from the moment of awareness.

Sources

  1. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
  2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
  3. European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (8, European Union, 2016)
  4. European Data Protection Board (2023). Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0. (79, EDPB, 2023)
  5. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6), 775-779. (75, Bainbridge, 1983)
  6. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3), 381-410. (76, Parasuraman & Manzey, 2010)
  7. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (62, Nordqvist, 2026)
  8. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 4. (64, Nordqvist, 2026)
  9. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (65, Nordqvist, 2026)
  10. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (66, Nordqvist, 2026)
  11. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Architecture as Code Series, Book 7. (67, Nordqvist, 2026)