Communication of AI system incidents
Description
Timely and appropriate communication to affected parties about AI system failures, security incidents, or adverse impacts.
Implementation Guidance
Incident Classification
Define AI incident severity levels: critical (safety harm, widespread discriminatory impact, data breach), major (significant performance degradation, limited discriminatory outcomes), minor (isolated errors, performance below threshold). Map communication requirements to each level.
Notification Protocols
Establish notification timelines and channels: critical incidents require immediate internal escalation and external notification within regulatory timelines, major incidents require notification within 48 hours, minor incidents are communicated in regular reporting. Identify notification recipients per incident type.
Incident Communication Content
Incident notifications should include: description of the incident and affected systems, potential impact on individuals, actions taken to mitigate, steps being taken to prevent recurrence, and contact information for questions. Use pre-approved templates for consistency.
Evidence Requirements
- AI incident severity classification matrix
- Notification protocol documentation
- Incident communication templates
- Incident notification records and timelines