Serious incident reporting failure

What it is

Several regimes require organisations to notify authorities of serious incidents: the EU AI Act for high-risk systems, data protection law for personal data breaches, financial regulators for material operational events, and operational resilience rules for major ICT incidents. An AI failure can fall under more than one at once. The risk is that an incident is handled operationally and its reportable nature is not recognised, or is recognised too late.

How it happens

• Incident classification has no criteria for AI-specific harm.
• Those handling the incident do not know a duty applies.
• Responsibility for notifying is unclear between provider and deployer.
• Time is spent establishing facts while the clock runs.

Why it matters

Late or missing notification is a breach in its own right, often treated more seriously than the incident. It also delays the response of authorities and of others who use the same system.

Warning signs

• The incident procedure does not mention AI or the regimes that apply to it.
• No one is named as responsible for regulatory notification of AI incidents.
• Past AI incidents were closed with no assessment of reportability.
• Contracts with suppliers are silent on who notifies.

Who owns it

Compliance owns the reporting obligations and the decision to notify. The incident manager ensures escalation. The system owner is accountable for timely recognition.

In practice

A model used to prioritise emergency repair calls misroutes requests for two days after an update. Engineers fix it and close the ticket. Three weeks later it emerges that vulnerable tenants were left without heating, and nobody had considered whether the event was reportable. The same pattern generalises to any incident resolved by the people who can fix it without reaching the people who know what must be reported.