County counsel wants vendor-model breach notice timelines reflected in operations. Which IR runbook update best aligns AI incident reporting with those requirements?

Vendor contracts and privacy or breach regulations often impose notice clocks measured in hours or days. County counsel's requirement that those timelines appear in operations is met by mirroring contractual and regulatory breach-notice timelines in the AI IR runbook's notification steps—who notifies whom, by when, with what minimum content, including vendor and regulator paths when AI systems process covered data. Mirroring annual vendor risk-review cadence timelines in the AI IR runbook's notification steps still misses the contractual and regulatory notice clocks that run in hours or days, not once a year; waiting for the annual cycle breaches the obligation long before that cycle arrives. Mirroring standard internal helpdesk restoration targets in the AI IR runbook's notification steps focuses on restoring service speed, not on embedding the breach-notice deadlines from contracts and regulations into the notification steps, so it does not meet counsel's requirement. Mirroring post-incident tabletop lessons-learned completion targets in the AI IR runbook's notification steps is an after-the-fact activity that does not establish who notifies whom, by when, under notice windows that run in hours or days. Exam caveat: mirroring timelines in the runbook does not replace legal judgment on whether an event is a notifiable breach; it ensures that once counsel determines notice is required, operations can meet the clock. Operational check: pick one AI vendor agreement, extract its notice period, and verify the runbook notification step cites that same period with an owner and contact method.