Serious incident register
Overview
Section titled “Overview”Govern → Compliance program → EU AI Act → Serious incidents is a register of serious incidents involving your AI systems. Each incident gets the reporting deadline of EU AI Act Art. 73, counted from when you became aware of it, and an alert goes out as soon as it is recorded. An incident still open after its deadline raises a second alert.
What counts as a serious incident
Section titled “What counts as a serious incident”Art. 3(49) of Regulation (EU) 2024/1689 defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to:
| Category | Art. 3(49) |
|---|---|
| Death of a person | (a) |
| Serious harm to health | (a) |
| Serious and irreversible disruption of critical infrastructure | (b) |
| Infringement of obligations under Union law intended to protect fundamental rights | (c) |
| Serious harm to property or the environment | (d) |
Reporting deadlines
Section titled “Reporting deadlines”The report is made immediately once a causal link (or its reasonable likelihood) is established, and in any event no later than:
| Incident | Deadline after becoming aware | Article |
|---|---|---|
| Widespread infringement (Art. 3(61)), or serious disruption of critical infrastructure | 2 days | 73(3) |
| Death of a person | 10 days | 73(4) |
| Any other serious incident | 15 days | 73(2) |
The shortest period that applies wins. An initial, incomplete report may be sent first and completed later (73(5)); Shield360 counts the initial report as meeting the deadline.
Record an incident
Section titled “Record an incident”You need the Manage findings and corrective actions permission (compliance.findings.manage).
Choose the AI system, give a short title (a case reference rather than the name of anyone affected), what happened, the category, whether it is a widespread infringement, and whether you report as provider or deployer.
The deadline runs from this moment. Save: the deadline appears at once and an ai_incident.recorded alert goes to your alert channels.
Track the report
Section titled “Track the report”Open an incident to record when the provider was informed, when the initial and complete reports were sent, the authority and its reference, and the investigation and corrective action (Art. 73(6)). A report date moves an open incident to Initial report sent or Reported. Not a serious incident closes it without a report when the investigation shows it did not meet the definition.
| Status | Meaning |
|---|---|
| Open, not reported | The deadline is running. Past it, the incident is overdue. |
| Initial report sent | An initial report went out; the clock stops. |
| Reported | The complete report went out. |
| Closed | Investigation and corrective action done. |
| Not a serious incident | Assessed as not meeting Art. 3(49). |
An incident whose first report went out after its deadline is marked Reported after the deadline.
Alerts
Section titled “Alerts”| Alert | When |
|---|---|
ai_incident.recorded | As soon as an incident is recorded. Critical for a death or a two-day deadline, otherwise a warning. |
ai_incident.overdue | Once per deadline, by the daily job, when an incident is still open with no report sent after its deadline. Critical. |
Alerts carry the category, the deadline and its Article paragraph, and the system’s name as the inventory found it. They never carry the title, summary or other text you typed, because alerts go to chat and email.
Controls
Section titled “Controls”The Serious incidents are reported in time check backs EU AI Act Art. 26, 72 and 73. It is a gap while any incident is overdue or one was reported late in the period, and not applicable while none is recorded; your attested procedure then stands for Art. 73.
Personal data
Section titled “Personal data”The title, summary, authority, reference and corrective action are free text that may name a person. A person export includes every incident whose text names them; erasure clears that text and keeps the incident, its dates and its deadline. The audit log records each change with the fields that changed, never the text.
| Method | Path | Permission | Body |
|---|---|---|---|
GET | /api/governance/eu-ai-act/incidents | compliance.read | |
POST | /api/governance/eu-ai-act/incidents | compliance.findings.manage | { assetKey, title, summary?, category, widespread?, reporterRole?, awareAt } |
PATCH | /api/governance/eu-ai-act/incidents/{id} | compliance.findings.manage | { status?, providerInformedAt?, initialReportAt?, reportSentAt?, authority?, reference?, correctiveAction?, title?, summary?, category?, widespread?, reporterRole?, awareAt? } |
category is one of death, health, critical_infrastructure, fundamental_rights or property_environment. Dates are ISO 8601, not in the future. An incident in another environment returns 404; malformed JSON returns 400; a change that lost a race with another returns 409.