Nearly automated, and honest about the nearly

The packet is frozen at the moment it goes out. The incident keeps being corrected afterwards — that is what an append-only register is for — and the document the insurer is holding does not change with it. An org that cannot answer "what did you tell them in March" is an org that loses the coverage argument.

Nothing here transmits to a carrier or a police force on its own, and a submission time records that somebody says they submitted it. Every recipient has its own portal and its own idea of what counts as filed, and they change without telling anyone. Reporting a regulator was notified when an email reached an unread mailbox would manufacture the single fact you are most exposed on.

"We considered telling the regulator and concluded we did not have to" is a defensible position — and it only exists if somebody recorded it with their name against it. Not-required is a real status, because an absent record is indistinguishable from nobody having thought about it.

Reporting delay runs from the moment the obligation surfaced, not from the incident. That is the clock a business can actually manage — the other one measures how long the news took to reach anybody, which is a different problem with a different fix, and conflating them hides whichever is broken.