AACF
Measure & Improve ยท MON-09

Serious AI incidents and external notification

The organisation defines serious AI incidents, can suspend a use of AI when needed, and tells suppliers, regulators and affected people through set routes and within set deadlines.

Why it matters

When AI causes or risks serious harm, the law may set short deadlines for telling the supplier and the regulator, and the people affected need to hear promptly. Deciding in advance what counts as serious, who can suspend a use and who must be told means these duties are met under pressure rather than missed.

Levels
0 AbsentConfirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0.
1 InitialSerious AI incidents are handled case by case; nobody has decided who must be told or who can suspend a use.
2 DevelopingSome notification duties are known, but serious incidents are not defined, deadlines are not set, or no one is named to suspend a use.
3 DefinedSerious AI incidents are defined, notification routes and deadlines and a decision point to suspend use are set, affected people are told under a plan, and risks short of a serious incident are reported and acted on.
4 ManagedSerious incidents lead to reviews of the use concerned, and notification and suspension decisions are reviewed with their actions tracked to completion.
5 OptimisingLessons from serious incidents, including those reported by other organisations, routinely change designs, controls and notification arrangements.
Level 3 criteria

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

  1. MON-09.1 Serious AI incidents are defined.
  2. MON-09.2 The definition of serious incidents meets what applicable law requires. HIR
  3. MON-09.3 Routes and deadlines for notifying suppliers of a serious incident are set.
  4. MON-09.4 Routes and deadlines for notifying regulators of a serious incident are set. HIR
  5. MON-09.5 A decision point to suspend a use of AI after a serious incident is defined.
  6. MON-09.6 A plan is in place for telling affected people about a serious incident.
  7. MON-09.7 When a use of AI presents a risk to health, safety or rights short of a serious incident, the supplier is told and use is suspended if needed.
  8. MON-09.8 When the law requires it, the regulator is also told of such a risk. HIR
Assessment questions
  • How are serious AI incidents defined here, and does the definition follow what the law requires?
  • Who can suspend a use of AI after a serious incident, and how quickly can they act?
  • Who must be told of a serious incident or a risk to health, safety or rights, by when, and how would affected people be told?
Evidence an assessor would expect
  • The serious incident definition and the legal source it follows
  • Notification routes and deadlines for suppliers and regulators
  • Suspension decision records, with the named decision maker
  • The plan for telling affected people about a serious incident
How to reach Level 3
  1. Define serious AI incidents as applicable law requires, using the obligations register (RSK-04).
  2. Set routes and deadlines for notifying suppliers and regulators of a serious incident, and a plan for telling affected people.
  3. Set a decision point and a named decision maker to suspend a use of AI after a serious incident.
  4. Where a use presents a risk to health, safety or rights short of a serious incident, tell the supplier, and the regulator where the law requires, and suspend the use if needed.
  5. Link these steps to the incident process (MON-04) so serious cases are recognised and escalated at triage.

Common pitfalls

  • Not deciding in advance who can suspend a use of AI, so suspension is delayed.
  • Waiting for an investigation to finish before notifying, and missing a legal deadline.

Starter artefacts

  • Notification routes and deadlines table
  • Suspension decision record
  • Plan for telling affected people
Ownership and sequence
Accountable
risk lead
Contributors
ai governance lead, business owner, delivery lead
Depends on
MON-04, RSK-04
Roadmap step
6
Lifecycle
deploy, operate
Cross-references
EU AI ActArt 26(5) direct; Art 73 direct; Art 17 partial
ISO/IEC 42001A.8.4 direct
JSP 936 Part 1para 91 direct
NIST AI RMF 1.0GOVERN 4.3 partial; MANAGE 2.3 direct; MANAGE 4.3 direct
UK Data and AI Ethics FrameworkSAT 4.10 partial

direct: this control at Level 3 meets the item. partial: it covers part of it.