---
title: "Build a 48-hour incident chronology from the tickets and emails"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-48-hour-incident-chronology-from-the-tickets-and-emails"
type: "task"
site: "AI Law Framework"
id: "A25-A20260923-4"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Build a 48-hour incident chronology from the tickets and emails

> Extract times, systems, actors and decisions from the incident tickets and correspondence into a chronology, marking gaps.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-48-hour-incident-chronology-from-the-tickets-and-emails  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Extract times, systems, actors and decisions from the incident tickets and correspondence into a chronology, marking gaps. |
| What the lawyer must review | Verify times against the source systems Use the chronology for the lawyer's assessment, not as a notification |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

Verify times against the source systems. The chronology is for the lawyer's assessment, not a notification.

- What the AI does: Extract times, systems, actors and decisions from the incident tickets and correspondence into a chronology, marking gaps.
- What the lawyer does: Set the scope, verify the evidence, resolve exceptions and approve the final output for its intended use.
- Basis: Suggested checking approach based on the task guidance. Complete the assessment for the actual tool, information and jurisdiction.

## Checks the lawyer makes

1. Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
2. Verify every relied-on citation, figure and name against the source document.
3. The responsible lawyer approves the exact version before use.

## Sources

- [Ten Things: 100 Practical Generative AI Prompts for In-House Lawyers, 31 March 2025](https://tenthings.blog/2025/03/31/ten-things-practical-generative-ai-prompts-for-in-house-lawyers/) (checked 2026-09-23)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Incident response plan outline](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-incident-response-plan.md) | Checklist | Yellow | An outline for a written incident response plan, arranged on the six functions in NIST SP 800-61r3. A Safeguards Rule plan is a separate box, and only if that rule applies. |
| [Breach notice with a statute checklist](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-breach-notice-state-checklist.md) | Letter | Yellow | A notice letter with two filled statutes: HIPAA breach notification to individuals, and New York General Business Law § 899-aa.… |
| [California security breach notice](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-california-breach-notice.md) | Notice | Yellow | Notice to a California resident under Civil Code § 1798.82, using the statutory title and headings. It leaves the facts in brackets.… |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-48-hour-incident-chronology-from-the-tickets-and-emails/united-states.md) | Green |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*