{"slug":"ai-incident-management-and-reporting","id":"AIPT-CTL-0004","title":"AI incident management and regulatory reporting","kind":"process","kind_label":"Process","purpose":"Ensures that harm or near-harm caused by an AI system is detected, contained, investigated and, where a rule requires it, reported to the right authority and affected people within the applicable time limit.\n","description":"The existing incident-response playbook is extended with AI-specific triggers: harmful or discriminatory output, safety failures, security breaches involving models or training data, misuse of the system and loss of control over an agent. A severity scale maps each trigger to the reporting regimes that may apply and their clocks, and a named coordinator decides within a set time whether a report is due. Investigation records the timeline, impact, root cause and corrective action, and lessons feed back into testing, monitoring and the risk register. Reporting channels for staff, users and third parties are published, and reports made to authorities are logged.\n","owner_role":"Incident coordinator","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["6.5","7.3","2.2","4.2"],"evidence":[{"type":"procedure","title":"AI incident response playbook","description":"Triggers, severity scale, reporting clocks per regime, roles and escalation."},{"type":"incident_record","title":"AI incident record","description":"Timeline, impact, root cause, corrective action and reporting decisions for one incident."},{"type":"regulatory_filing","title":"Incident report to an authority","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 10.2; Annex A.8.3, A.8.4","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 4.1, 4.3; GOVERN 4.3, 6.2","note":null,"confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 5.24 to 5.28 Information security incident management","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","relationship":"supports","note":"Tracking and reporting serious incidents to the AI Office.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk"},{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","relationship":"satisfies","note":"Serious-incident criteria, causal-link decision and the reporting clock in the playbook.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting"},{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","relationship":"satisfies","note":"Investigation, corrective action and notification of authorities and the supply chain.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information"},{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","relationship":"satisfies","note":"Suspension decision and notifications to provider and authority.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension"},{"slug":"eu-ai-act-art-55-systemic-risk-incident-reporting","title":"Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office","relationship":"satisfies","note":"Model-level incident criteria, log and AI Office reporting.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","relationship":"supports","note":"Monitoring findings escalate into incidents.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"us-california-sb-53-critical-safety-incident-reporting","title":"Report critical safety incidents to the Office of Emergency Services","relationship":"satisfies","note":"Critical-safety-incident criteria and escalation to the state office within the statutory time.","confidence_level":"high","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting"},{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","relationship":"satisfies","note":"Breach notification to the Board and individuals within the incident process.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification"},{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","relationship":"supports","note":"Reports feed the incident process.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections"},{"slug":"us-colorado-ai-act-developer-disclosure-to-attorney-general","title":"Developers must notify the Attorney General and deployers of discovered algorithmic discrimination","relationship":"satisfies","note":"Discrimination findings treated as reportable incidents with the 90-day clock.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","relationship":"supports","note":"Incident response and communication outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"singapore-mgf-genai-incident-reporting-and-provenance","title":"Report incidents and mark AI-generated content (generative AI framework)","relationship":"satisfies","note":"Incident reporting channel and process.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance"},{"slug":"south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","title":"Operators of AI above the compute threshold must run lifecycle risk management and report safety results","relationship":"supports","note":"Incident monitoring and response arm of the risk management system.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai"},{"slug":"us-colorado-ai-act-deployer-disclosure-to-attorney-general","title":"Deployers must notify the Attorney General of discovered algorithmic discrimination","relationship":"satisfies","note":"Discrimination discovery treated as a reportable incident with the statutory clock.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general"}],"related_controls":["post-market-monitoring-and-drift-detection","record-keeping-and-logging","genai-red-team-testing","privacy-and-data-protection-for-ai"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting","context_url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting.md"}