AI incident

The OECD distinguishes AI incidents, where harm has occurred, from AI hazards, where an event could plausibly lead to harm. The EU AI Act defines a narrower serious incident: an incident or malfunction of an AI system leading to death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental rights obligations, or serious harm to property or the environment. Providers of high-risk systems must report serious incidents to market surveillance authorities within short deadlines, and deployers must inform the provider when they identify one.

An AI incident response plan defines detection channels, triage criteria, roles, containment options such as switching a model off, investigation, communication and lessons learned. Many AI incidents are also personal data breaches or security incidents, so the plan must connect to breach notification duties under data protection law instead of running in parallel.

Example: a chatbot starts disclosing other customers' order details after an update; the company disables it, investigates and assesses whether a breach notification is required.