---
title: "Decide the risk with a fixed method · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-risk-method
updated: 2026-10-20
licence: "All rights reserved"
---

# Decide the risk with a fixed method

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting)
- Rule: Decide whether a breach must be reported with one written scoring method, and store the score next to the decision.
- How: Under Article 33, you report unless the breach is unlikely to result in a risk to people. Under Article 34, you tell the people affected when the risk is high. Use a public method, such as the ENISA breach severity method, and the EDPB examples in guidelines 01/2021. Score the kind of data, how easily people can be identified and the harm that could follow. Data encrypted with a key that did not leak usually scores low. Write the score that means report to the authority and the score that means high risk next to the method.
- Check: Every register entry has a method name, a score and a decision. A script fails when a score at or above the reporting threshold has `reported_to_authority: false`. It also fails when a score at or above the high-risk threshold has `people_told: false`.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-risk-method`.

- Previous: [Log every breach with its decision](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-register)
- Next: [Keep the notices ready](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-notice-templates)
- [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting)