Regulatory incident notification

What it does

It makes sure that an incident reaches the people who know what must be reported. Every significant AI incident is assessed against the reporting duties that could apply: serious incidents under the EU AI Act, personal data breaches, sector regulators' rules and operational resilience requirements. Compliance owns the criteria and the decision to notify; the incident manager is responsible for escalating. It operates during incident response, as soon as an incident is recognised.

How to implement it

• List each reporting duty with its trigger, recipient and deadline, and keep the list current.
• Add a reportability assessment to the incident procedure as a mandatory early step.
• Name who decides and who deputises out of hours.
• Agree in contracts who notifies whom between provider and deployer.
• Prepare notification templates and contact details in advance.
• Record the assessment even when the conclusion is that no report is needed.

Evidence it operates

Design: reporting criteria mapped to each regime; a notification procedure. Operation: reportability assessments for past incidents with times recorded; copies of notifications made; contract terms on notification; results of an exercise that tested the route.

Where it fits

Part of incident response, alongside AI incident response and rollback. It is the primary control for serious incident reporting failure and depends on the AI regulatory obligations register to keep its criteria correct.

Limits

It acts after harm has occurred. Notification can only follow recognition, and the usual failure is that an AI fault is fixed as a technical matter and never assessed. Deadlines begin before the facts are clear, so first reports are often incomplete. One event can fall under several regimes with different recipients and timetables.