In short
- Say something true, early. Organisations that break their own bad news are judged more credible than those found out.
- A holding statement says what you know, what you are doing, that you care, and when you will say more. It does not speculate.
- Several legal and regulatory clocks may already be running. Check them in the first hour, not the first week.
- One owner, one log, one version of the facts across every channel, with staff hearing it from you first.
- Keep updating even when there is little new to say. A silence fills with rumour.
Why the first hours matter
People often talk about a “golden hour” in crisis communications. The evidence is more nuanced than that, and more useful.
The best-known finding is about who tells the story first. In a 2005 study, organisations that disclosed crisis information themselves (“stealing thunder”) were rated as more credible than those whose crisis was revealed by a third party. Later work found the benefit weakens when audiences see the disclosure as a persuasion tactic, so early and self-serving is not the same as early and honest. Research on timing is less clear-cut: one experiment found no meaningful difference in trust between a Facebook response posted after an hour and one posted after a day, while a response after a week did worse.
Practitioners have moved faster than the research. The Chartered Institute of Public Relations now says the aim is often an initial response within about fifteen minutes, then regular updates, sometimes several a day. The conclusion we draw for clients: there is no magic number, but there is a clear principle. Be the first credible source of information about your own crisis, and keep being it.
Straight away: establish, convene, log
- Establish the facts. What happened, where, when, who is affected, and what you do not yet know. Keep the known and the unknown separate from the start.
- Convene the crisis team and name one person who owns communications. Everything public goes through them.
- Start a single log of facts, decisions and times. It keeps the team consistent, it answers “when did you know?”, and regulators may ask for it.
- Check the clocks. Work out which notification duties below apply to you, and when each started.
The clocks that start ticking
While the communications team is drafting statements, legal and regulatory duties may already be running. They shape what you can say and when. These are the ones we see most often.
| If this happens | Who you tell | How fast |
|---|---|---|
| A personal data breach that risks people’s rights and freedoms | The Information Commissioner’s Office | Without undue delay, and not later than 72 hours after becoming aware (UK GDPR Article 33). You can report in phases. |
| A data breach likely to result in a high risk to individuals | The people affected | Directly and without undue delay (Article 34). |
| Inside information about a listed company | The market | As soon as possible (UK MAR Article 17). Delay only if all three legal conditions are met, then tell the FCA once it is disclosed. FCA rules allow a short delay after an unexpected, significant event if needed to clarify the situation. |
| Anything an FCA-regulated firm’s regulator would reasonably expect to know, including matters that could significantly harm its reputation | The FCA | Immediately on becoming aware (SUP 15.3). The FCA expects to hear before the firm makes internal or external commitments. |
| A serious incident at a charity: harm to people, significant loss, damage to property or reputation | The Charity Commission | Promptly: as soon as reasonably possible after it happens or after the charity becomes aware. Trustees are responsible. |
| A work-related death, specified injury or dangerous occurrence | The Health and Safety Executive (RIDDOR) | Without delay, with a report received within 10 days. Over-seven-day injuries within 15 days. |
| An incident with a significant impact on an essential service (operators under the NIS Regulations) | The sector’s competent authority | Without undue delay and no later than 72 hours after becoming aware. |
One to watch: the Cyber Security and Resilience Bill, before the House of Lords in September 2026, would bring in an initial cyber incident notification within 24 hours and a full report within 72. It is not yet law. This table is a prompt, not legal advice: your lawyers and compliance team decide what applies.
Before anything goes public
- Staff first, or at the same time. People who learn about their own organisation’s crisis from the news stop trusting what it tells them. They are also your most likely source of leaks and your most credible ambassadors.
- Regulators. Make the notifications you are required to make. If you are FCA-regulated, talk to the FCA before committing to anything externally.
- Sign-off. Agree who approves statements and how fast. A sign-off chain that takes a day will lose the first day.
- The spokesperson. Choose them now. Seniority matters: the more serious the incident, the more senior the voice people expect to hear.
The holding statement
A holding statement buys you time without leaving a vacuum. The Government Communication Service’s behavioural guidance puts the essentials simply: tell people what is known, what is not known, what they should do and why, and when to expect more information. Set expectations that the information may change as more becomes known.
A holding statement should:
- Say what happened, as far as you know it, in plain language
- Say what you are doing about it
- Show concern for the people affected, before concern for the organisation
- Tell people what to do, if anything
- Say when you will update next, and then do it
It should not speculate about causes, blame anyone, or promise what you cannot yet know.
Draft holding statements for your most likely scenarios in advance, and have them approved before you need them. On the day you then fill in facts rather than argue about wording.
One voice, one version of the facts
The Cabinet Office’s emergency response guidance warns that the media will have an insatiable appetite for detail and will seek information wherever and from whoever they can, and that inconsistent information causes alarm and a loss of confidence. Its answer is early coordination: a core brief that every responding organisation works from, and in larger incidents a single press office.
The same applies inside one organisation. The website, social channels, customer service scripts, staff briefing and the spokesperson should all say the same thing. The guidance also suggests treating the website as a continuous medium, like 24-hour news, that needs regular updating.
Keep feeding the vacuum
“Rumour and conjecture will flourish in a vacuum,” in the words of the Cabinet Office guidance, which recommends regular updates even when there is little new to say. An update that says “no change, next update at 4pm” is still an update. It keeps you as the source people come back to.
Monitor news and social media from the start, and log what is being said. It tells you which questions to answer next and which errors need correcting.
Correcting misinformation without spreading it
A statement you have heard before feels truer than one you have not, whether or not it is true. Psychologists call this the illusory truth effect, and Hilary and Professor Peter Kinderman discuss it on the Experience podcast. For a spokesperson it means that repeating an allegation in order to deny it can strengthen it. Lead with the accurate information, state it plainly and often, and mention the false claim briefly, if at all. “Our water is safe to drink” works harder than “It is not true that our water is unsafe.”
After the first day
The Government Communication Service frames crisis work as a cycle it calls PRIMER: plan, rehearse, implement, maintain, evaluate, recover. The last three are the ones organisations skip once the headlines move on. Review what happened while memories are fresh, write down what you would do differently, update the plan and then rehearse it.
Rehearsal is where most plans prove themselves or fall apart. A realistic exercise with a live news feed, journalists on the phone and social media moving faster than the sign-off chain shows a team where its gaps are while it still costs nothing to find them. That is what our crisis simulations are for. To see where you stand today, try the crisis readiness check.
Crisis communications: first hours checklist
0 of 20 done
Straight away
Before anything goes public
Your first statement
Keep going
Afterwards
Your ticks are saved in this browser only. Nothing is sent anywhere.