GDPR Article 33 obligation to notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach likely to result in risk to individuals. Article 34 requires notification to affected individuals where the risk is high. A separate incident-reporting obligation applies to high-risk AI system providers under Article 73 of the AI Act.