How do I triage a suspected reportable situation?

The trigger

A staff member reports that a tool exposed customer data, a vendor emails that it is investigating an incident, or a complaint escalation hints at something wider. Each can be the first sign of a matter with a statutory clock attached, and a third party's breach can start your clock from the moment your organisation becomes aware. The first hour decides whether the regime owner receives evidence or hearsay.

The inputs

• The initial report exactly as received, with its timestamp
• The system, vendor or process involved and where its records and logs live
• Your incident intake checklist and evidence pack template
• The contract notification clause, if a vendor is involved
• The list of regime owners: privacy officer, breach reporting owner, complaints owner, whistleblower program owner

The steps

1. Run the whistleblower gate first. If the matter could be a protected disclosure, stop: it never goes into a general AI tool. Hand it to an eligible recipient and end this recipe.
2. Preserve the raw evidence in the approved incident system: the report as received, timestamps, prompts and outputs if AI was involved, and the location of any vendor or system logs. Build an evidence pack, not a bare ticket.
3. Build a banded working record for AI use. Replace every name, date and system identifier with placeholders such as [DATE_BAND], [BUSINESS_AREA_BAND], [ALLEGATION_CATEGORY] and [SYSTEM_CATEGORY].
4. Run the prompt below over the banded record in your approved AI tool. It produces a chronology separating confirmed facts, working assumptions and unresolved questions.
5. Review the routing questions it returns on which regimes could be engaged: a privacy breach assessment, licensee breach reporting, or the complaints regime with its own enforceable clock. Treat them as a routing aid, never a conclusion.
6. Route the pack to the owner of each candidate regime, record the handover time, and flag that the awareness moment may already have started a clock.

The prompts

Paste the banded record only. Never the raw report.

You are structuring the first hour of a suspected incident for an
Australian compliance team. Use only the banded facts below. Do not
assess whether anything is reportable, notifiable or a breach of any
law, and do not state that any statutory test is met.

Produce:
1. A chronology table with three columns: confirmed fact, working
   assumption, unresolved question.
2. A list of evidence to preserve now, based only on the facts.
3. Routing questions for the regime owners, phrased as questions a
   human must answer, such as whether personal information was
   involved and whether a third party holds the records.

Banded facts:
[DATE_BAND]
[BUSINESS_AREA_BAND]
[ALLEGATION_CATEGORY]
[SYSTEM_CATEGORY]
[FACTS_AS_RECEIVED_BANDED]

The checks

• Check every chronology entry against the source record before the pack moves
• Search the prompt and output for names, exact dates or system identifiers; if any appear, delete the chat and rebuild the banded record
• Confirm the output contains no reportability conclusion; if the tool drifted into one, strike it
• Confirm the awareness timestamp is recorded, because a clock may run from it

Governance controls

• The reportability assessment belongs to the human who owns the relevant regime. AI assembles and structures; it never classifies the matter against a statutory test and never drafts a regulator notification unreviewed.
• Banded placeholders are mandatory for a live incident. No raw names, dates or system identifiers enter any AI tool.
• The whistleblower gate is absolute: a matter that could be a protected disclosure goes to an eligible recipient with no AI involvement at any step.
• Record what the AI structured and what the person decided, and keep the raw evidence in the incident system.
• Hand any vendor contract notification clause to the regime owner in the same handover; the notice window shapes everything after.

The output

A one-page triage pack: a fact-checked chronology, a preserved evidence list, routing questions, and a recorded handover to the regime owner who makes the assessment.

Time it takes

About 60 minutes on the first run, most of it building the banded record carefully. A practised run with templates in place lands closer to 30.