When something goes seriously wrong, will we know, and will the right people?
Baseline: 1Enhanced: 34 controls
Who it applies to
Enter for every AI system. Go as deep as your system letter, and implement in your mode.
Why it exists
Define what counts as an AI incident, detect it, and escalate it to people who can act — because AI fails in ways your existing incident process may not recognise as incidents at all. A model that has been quietly producing biased decisions for weeks, a system leaking data through its answers, an agent acting outside its bounds: these may trip no traditional alarm, yet each demands response. Name them as incidents, wire detection to them, and route them to the AI incident capability the Governance security program stood up.
What to actually do
Define the AI failure modes that count as incidents, and detect them. Name what qualifies — significant drift, systematic error or bias, data leakage through outputs, an agent exceeding its bounds, a successful manipulation — and connect your monitoring so these are detected and raised, not left to surface as complaints.
Escalate to the AI incident team, on a defined path. Route detected incidents to the cross-functional AI incident team from the Governance security program, on a path everyone knows, with the severity levels and timeframes decided in advance.
Controls
Baseline1 controls
Control 211
Define what counts as an AI incident and name the escalation contact.
BaselineCorrectiveall rolesthe whole organisation
What it is
Drift, systematic error or bias, leakage through outputs, an out-of-bounds action, a successful manipulation — written down, with one named person to whom any of them is reported.
How to implement it · Minimum structure
Definition: drift, systematic error or bias, leakage through outputs, an out-of-bounds action, a successful manipulation — each with one example from own use
One named person to whom any of them is reported, plus a deputy
How to report: phone or email, and what to include (tool, time, what happened)
First actions of the contact: record it, decide whether to stop the tool
Circulated to everyone who uses AI at work
How to start
Write the five incident types with one example each from your own AI use, add the contact's name and phone, and send it to all staff.
Evidence
The written incident definition and the named contact, with proof it was circulated.
Mode: light / standard / full
light
A half-page note; the owner-manager is the contact.
standard
The definition sits in the incident policy, with the security or IT lead as contact.
full
Part of the incident management policy, with the AI incident team's on-duty contact and an intranet reporting form.
Enhanced3 controls
Control 209
Define AI-specific incidents and wire detection to them.
EnhancedDetectiveall rolesper system
What it is
Drift, bias, leakage, out-of-bounds action, and successful manipulation all raise incidents.
How to implement it · Minimum rules
Drift: performance crosses the action threshold
Systematic error or bias: outcome gap between groups beyond tolerance, or repeated upheld challenges of one kind
Leakage: personal or confidential data detected in outputs
Out-of-bounds action: an agent acting outside its permitted scope, tools or limits
Successful manipulation: a confirmed bypass of guardrails or instructions
Each type wired to a monitoring signal or a named reviewer who raises it
How to start
Write the incident definitions for this system and, for each, name the monitoring signal that will raise it; close any type with no signal.
Evidence
The incident definitions, the detection wiring for each, and the incidents raised.
Mode: light / standard / full
light
Each type mapped to a manual check or provider alert, with a named person who raises it.
standard
Monitoring alerts configured to open incidents for each type, owned by the system owner.
full
Detection rules per type in security monitoring, tested and tuned by security operations.
Control 210
Escalate on a defined path to the AI incident team.
EnhancedCorrectiveall rolesper system
What it is
Severity levels and timeframes set in advance.
How to implement it · Minimum structure
Severity levels, e.g. critical (harm to people, data leak, reportable), high, low
Timeframes per level, e.g. critical escalated within 1 hour, high within 24 hours
Path: whoever detects → on-duty contact → AI incident team lead → management
Contacts with deputies, reachable out of hours for critical incidents
Record of each incident: detected, escalated, acknowledged, with timestamps
How to start
Write the severity levels and timeframes on one page with the contact names, and circulate it to everyone who operates or monitors the system.
Evidence
The escalation path document and incident records with their timestamps.
Mode: light / standard / full
light
A one-page path with the owner-manager and an external adviser as the incident team.
standard
A documented path to a cross-functional incident team, with an on-call rota for critical cases.
full
Escalation built into the incident management system, with automated paging and timeframe tracking.
Control 212
Report serious incidents to competent authorities within regulated timeframes.
EnhancedCorrectiveall rolesthe whole organisation
What it is
Where the rules that apply to you require serious AI incidents to be reported, the duty usually binds those who use AI as well as those who build it. The playbook names the authority, the timeframe and the reporter.
How to implement it · Minimum structure
Which rules bind the organisation and what counts as a serious incident under each
Competent authority for each rule, with the submission route
Timeframe from awareness, as each rule sets it, often days or hours
Reporter: a named person and deputy who submit, and who approves the content
Coordination with the provider where it must also report
Record of each report: submitted, timestamp, reference received
How to start
Obtain legal advice on which reporting duties apply to the organisation's AI uses, and write the authority, timeframe and reporter into the incident playbook.
Evidence
The playbook entries and the reports submitted with their timestamps.
Mode: light / standard / full
light
An external adviser identifies the duties once; the owner-manager is the reporter.
standard
The compliance lead maintains the playbook and acts as reporter, with legal approving reports.
full
A regulatory reporting function with templates, deadline tracking and board notification.
Evidence
The AI incident definitions; the detection wiring and escalation path; incident records and their handling. The written incident definition and contact; regulatory reports and their timestamps.