Meet Breach Notification Deadlines Without Cutting Corners

AI drafts legally compliant breach notifications fast. Legal counsel reviews every word before delivery to affected individuals.


Why this matters

Data breach notifications have strict legal requirements and tight deadlines — GDPR requires notification within 72 hours, US state laws vary from 30 to 90 days. Errors in notification content can increase liability and trigger regulatory penalties. Under the stress of an active breach, teams struggle to draft accurate, legally compliant notifications quickly enough.


How MultiMail solves this

MultiMail's AI agent rapidly drafts breach notifications with required legal elements — incident details, affected data types, remediation steps, and contact information. Gated_all oversight ensures legal counsel reviews every word before any notification reaches affected individuals.

1

Receive Breach Report

When a data breach is confirmed, your incident response team provides the details: affected data types, number of individuals, timeline, and remediation steps taken.

2

AI Drafts Notifications

The agent drafts notifications with all legally required elements for the applicable jurisdictions, including specific data types compromised, what actions users should take, and how to contact your organization.

3

Legal Reviews Everything

With gated_all oversight, every notification element is reviewed by legal counsel. The recipient list, subject line, and body content all require explicit approval.

4

Send and Document

Approved notifications are sent immediately. MultiMail logs every delivery with timestamps, providing evidence of timely notification for regulatory compliance.


Implementation

Draft a Data Breach Notification
python
import requests

API = "https://api.multimail.dev/v1"
HEADERS = {"Authorization": "Bearer mm_live_xxx"}

response = requests.post(
    f"{API}/send",
    headers=HEADERS,
    json={
        "from": "[email protected]",
        "to": ["[email protected]"],
        "subject": "Important security notice regarding your account",
        "text_body": (
            "Dear User,\n\n"
            "We are writing to inform you of a security incident that "
            "may have affected your personal information.\n\n"
            "WHAT HAPPENED:\n"
            "On March 10, 2026, we discovered unauthorized access to "
            "a database containing customer information.\n\n"
            "WHAT INFORMATION WAS INVOLVED:\n"
            "- Email addresses\n"
            "- Names\n"
            "- Hashed passwords (not plaintext)\n\n"
            "WHAT WE ARE DOING:\n"
            "- Forced password resets for all affected accounts\n"
            "- Engaged third-party security firm for investigation\n"
            "- Enhanced database access controls\n\n"
            "WHAT YOU SHOULD DO:\n"
            "1. Reset your password at https://yourcompany.com/reset\n"
            "2. Enable two-factor authentication\n"
            "3. Change this password on other sites if reused\n\n"
            "CONTACT US:\n"
            "Email: [email protected]\n"
            "Phone: 1-800-555-0123\n\n"
            "We sincerely apologize for this incident."
        ),
        "html_body": "<h2>Important Security Notice</h2><p>We are writing to inform you...</p>"
    }
)
print(f"Breach notification queued for legal review: {response.json()[&"cm">#039;id']}")

Compose a legally compliant breach notification queued for legal review.

Send Notifications to Affected Users in Batches
python
import requests

API = "https://api.multimail.dev/v1"
HEADERS = {"Authorization": "Bearer mm_live_xxx"}

"cm"># Get list of affected users (from your incident response system)
affected_users = get_affected_users()

sent_count = 0
for user in affected_users:
    response = requests.post(
        f"{API}/send",
        headers=HEADERS,
        json={
            "from": "[email protected]",
            "to": [user["email"]],
            "subject": "Important security notice regarding your account",
            "text_body": (
                f"Dear {user[&"cm">#039;name']},\n\n"
                f"We are writing to inform you of a security incident...\n\n"
                f"Your affected data: {&"cm">#039;, '.join(user['affected_data_types'])}"
            )
        }
    )
    sent_count += 1

print(f"Queued {sent_count} breach notifications for legal review")

Distribute breach notifications to all affected individuals.

MCP Tool: Breach Notification Management
typescript
"cm">// Draft breach notification (gated_all: full legal review)
const result = await mcp.send_email({
  to: "[email protected]",
  subject: "Important security notice regarding your account",
  text_body: "We are writing to inform you of a security incident..."
});

"cm">// Tag for incident tracking and compliance
await mcp.tag_email({
  email_id: result.id,
  tags: ["breach-notification", "INC-2026-003", "pending-legal-review"]
});

"cm">// Check legal approval queue
const pending = await mcp.list_pending({
  mailbox_id: "security-mailbox-id"
});
console.log(`${pending.emails.length} notifications awaiting legal review`);

"cm">// After approval: verify delivery
for (const email of pending.emails) {
  const status = await mcp.read_email({ email_id: email.id });
  console.log(`${status.to}: ${status.status}`);
}

Use MCP tools to manage breach notification distribution and tracking.


What you get

Meet Regulatory Deadlines

AI drafts notifications rapidly, giving legal counsel maximum review time within tight regulatory windows. GDPR's 72-hour and state-specific deadlines are achievable.

Legally Compliant Content

The AI includes all required elements: incident description, data types affected, remediation steps, and contact information per GDPR, HIPAA, and state breach notification laws.

Legal-Reviewed Every Word

Gated all oversight ensures legal counsel approves every notification before delivery. Every word carries legal weight, and the wrong phrasing can increase liability.

Compliance-Ready Audit Trail

MultiMail logs every notification with delivery timestamps and recipient details, providing evidence of timely notification for regulators and courts.


Recommended oversight mode

Recommended
gated_all
Breach notifications carry severe legal, regulatory, and reputational consequences. Every word can affect liability exposure. Legal counsel must review all elements — recipient identification, incident description, and remediation guidance — before any notification is sent.

Common questions

Which breach notification laws does this help comply with?
The AI drafts notifications with elements required by GDPR (72-hour notification), HIPAA (60-day notification), California (fastest in US), and all 50 US state breach notification laws. Your legal team customizes the draft for the specific jurisdictions applicable to your situation.
How do we handle notifications across multiple jurisdictions?
Your AI agent can draft separate notification versions for different jurisdictions with their specific required elements. GDPR notifications differ from California notifications in content requirements. Each version enters the legal review queue independently.
Can we prove notifications were sent on time?
Yes. MultiMail logs every sent email with precise timestamps, recipient addresses, and delivery status. This audit trail serves as evidence of timely notification compliance for regulatory inquiries, lawsuits, and insurance claims.
What if we need to send updates after the initial notification?
The AI agent can draft follow-up notifications as your investigation progresses. Use reply_email to maintain the thread context so recipients see updates in the same conversation as the original notification.
Do AI-sent breach notifications need special disclosure under the EU AI Act?
Yes. EU AI Act Article 50 requires that AI-generated content be marked in machine-readable format regardless of content type. MultiMail automatically includes a signed ai_generated disclosure in the identity header of all AI-sent emails, including breach notifications. This means your breach notifications are compliant with both data breach notification laws and AI disclosure requirements simultaneously.

Explore more use cases

The only agent email with a verifiable sender

Email infrastructure built for AI agents. Verifiable identity, graduated oversight, and a 38-tool MCP server. Formally verified in Lean 4.