Relying party · Energy & critical infrastructure
Agents in critical infrastructure
NIS2 demands an early warning within 24 hours of awareness. Can your agent trigger it — and is it allowed to?
Since § 32 of the German BSI Act, a three-stage reporting duty applies: 24-hour early warning, 72-hour follow-up, one-month final report — via the BSI reporting portal. The channel is mandatory and requires a registered identity. Mandact lists `kritis.incident.report` as prepare_only and names the deadline in the mandate so your process plans for it.
Use cases
Reporting deadlines visible
The catalogue carries the 24 hours on the action type — Mandact does not police them, but it does not conceal them either.
Grid interventions escalate
`grid.load.shed` and `safety.system.override` are never agent business; the second is categorically sealed.
Mandatory channel named
The BSI reporting portal instead of e-mail — the action is only effective through this path.
ROI argument
One missed 24-hour deadline costs more than any integration.
Action catalogue tier 9: five types with channel and deadline.