incident-reporting-navigator

What it does

This skill produces a cited notification map showing which EU regimes fire for each involved entity, which authorities receive notifications in which member states, and every deadline, using live legal text fetched through the Ansvar Gateway MCP connector. It identifies, for each regime and entity, the applicable duties and recipients, and it does not draft the notifications themselves. It requires an active connection to the Ansvar Gateway MCP connector and uses a defined set of tools to fetch provisions and related data.

How it works

• It requires the Ansvar Gateway MCP connector at https://gateway.ansvar.eu/mcp with OAuth 2.1 Dynamic Client Registration.
• It uses the tools: search, get_provision, get_my_capabilities, and, if a CVE is involved and consent is given, get_cve_details and check_kev_status.
• It proceeds in four steps:
  1. Staged intake: collects entity-regime matrix, incident class and impact, per-entity per-regime timestamps.
  2. Regime screen: runs a scoped search per regime to mark as candidate or not evaluated.
  3. Per-regime determination: for each candidate, fetches regime provisions in a fixed order (scope, trigger tests, duties, and recipients); applies regime-specific articles and any framework provisions; accounts for cross-regime relationships where specified.
  4. Authority resolution: resolves receiving authorities per member state by consulting national transposition rows, verifies status and dates, and names authorities only from fetched rows; if unresolved, reports the authority class with a citation and marks the concrete name as regulatory basis unresolved.

When to use it

• Use when a security incident, data breach, or actively exploited vulnerability necessitates cross-regime EU notification planning, and you need a jurisdiction-specific, citation-backed map of duties, authorities, and deadlines. It is intended to determine what must be reported, to whom, and by when, not to draft actual notifications.

What it can touch

• The skill engages the Ansvar Gateway MCP connector and uses the following tools: search, get_provision, get_my_capabilities, and optionally get_cve_details and check_kev_status when a CVE is involved and consent is provided.
• All data used in conclusions must come from tool results; no memory-based conclusions are allowed.

Caveats

• All deadlines and authorities must be quoted or cited from fetched provisions; if results are incomplete or a provision status is unclear, the outcome must reflect that with appropriate caveats (e.g., regulatory basis unresolved).
• The workflow relies on live gateway data; if the gateway is unavailable, the skill will stop and inform the user to connect the gateway.
• The review respects the rule that only data from official sources and citations are used; no outcomes are inferred from memory or non-official sources.