Legal answers you can trace to the law.

GraphRAG for government and legal teams. Every answer traceable to article and paragraph, designed for processing within Europe.

Request a pilot Explore the platform

Answer

For a significant incident: an early warning within 24 hours, an incident notification within 72 hours.

A final report follows within one month. For a personal data breach, also notify the supervisory authority, unless a risk is unlikely.

NIS2 art. 23(4) GDPR art. 33(1)

An answer without a source is an opinion.

General AI assistants sound certain, even when they are wrong. In law, that is unusable. Veracto only answers when the source supports it, and shows you which source that is.

From question to provision, visible at every step.

When do we have to report an incident?

Recognised

reporting dutysignificant incidentNIS2

NIS2 art. 23(4)(a)

…without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning…

NIS2 art. 23(4)(b)

…in any event within 72 hours of becoming aware of the significant incident, an incident notification…

NIS2 art. 23(4)(d)

…a final report not later than one month after the submission of the incident notification under point (b)…

GDPR art. 33(1)

…unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons…

Cbw · reporting transposes NIS2 art. 23

NIS2 art. 23 uses term from NIS2 art. 6

Cbw · reporting overlaps with GDPR art. 33

For a significant incident: an early warning within 24 hours¹, an incident notification within 72 hours² and a final report within one month³. For a personal data breach, also notify the supervisory authority, unless a risk is unlikely⁴.

Or, when the source is missing

The loaded sources contain no fine amount for your sector. I will therefore not answer that part of the question.

Your question

Asked in plain language. Veracto recognises references to article, paragraph, point and ECLI, and uses them to search.
Retrieving sources

We search your own, isolated collection. Every passage keeps its document, article, paragraph and page.
Following the links

Transpositions, references and definitions are stored in a knowledge graph. Related provisions come along, not just the top search hit.
Answer or refusal

Every claim points to a literal quote. When the source does not support it, Veracto says so instead of guessing.

Designed to keep confidential documents in Europe.

Condition for every pilot

Processed in the EU

Storage, search indexes and language models on European infrastructure, with no transfers to third countries.

In development

On your own servers

Built so it can also run in your own data centre or private cloud.

Condition for every pilot

Never trained on your data

Your documents are used to answer, never to train models. We put that in the contract.

Available

Isolated workspaces

Every matter gets its own workspace with its own index and knowledge graph.

Available

Traceable

For every answer, the question, the sources used and the quotes are recorded, so a reviewer can check them.

query   incident reporting
source  NIS2 art. 23(4)
source  GDPR art. 33(1)
status  answered, 4 citations

Read what exists today and what is coming

What we have measured. And what not yet.

Veracto is in development. We publish our evaluations, weak spots included, because you should be able to judge what the system can do.

of answers legally correct: 88%
of citations supported by the quoted source: 100%
unanswerable questions correctly refused: 10/10
of answers with a material error: 3%

Still open

Questions that span several articles are not yet answered completely enough: 4 out of 15 were complete. We are working on that now, and only after that will we go beyond a pilot.

Internal evaluation, 2026: 60 answers to Dutch NIS2 questions, blind-reviewed by one assessor. The same question set as earlier rounds, so not an independent test and no proof of accuracy in practice.