Skip to content

Lifecycle & third parties

Incidents & corrective action: what AI regulations require

Detection, notification to authorities, corrective action.

21 requirements · 12 regulations · 12 checks

Requirements by regulation

EUAI Act4

EX-013

Corrective actions Art. 20

EX-021

Post-market monitoring Art. 72

EX-022

Serious incident reporting Art. 73

EX-032

GPAI obligations with systemic risk Art. 55

EUDORA2

DORA-17

Classification and reporting of major incidents (4h / 72h / 1 month) Art. 17-19

DORA-11

Continuity, response and recovery Art. 11

EUNIS21

NIS2-23

Incident reporting (24h / 72h / 1 month) Art. 23

EUCRA1

CRA-14

Report actively exploited vulnerabilities and severe incidents (24h / 72h / 14d) Art. 14

USNIST AI RMF6

GOVERN-1.5

Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review. GOVERN

GOVERN-4.3

Organizational practices are in place to enable AI testing, identification of incidents, and information sharing. GOVERN

GOVERN-6.2

Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk. GOVERN

MANAGE-2.3

Procedures are followed to respond to and recover from a previously unknown risk when it is identified. MANAGE

MANAGE-4.1

Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management. MANAGE

MANAGE-4.3

Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented. MANAGE

COColorado AI Act1

CO-04

Report to the Attorney General within 90 days §6-1-1702(5), 1703(7)

CASB 531

SB53-03

Report critical safety incidents to OES within 15 days (24h if imminent) §22757.13

BRPL 23381

BR-15

Serious incidents Arts. 25 §7, 42

KRAI Basic Act1

KR-06

Safety of high-compute models Art. 32

CNChina GenAI1

CN-05

Handle illegal content and correct the model GenAI Art. 14

INTLISO 420011

ISO-A.8

Information for interested parties, incident communication A.8

Checks in this theme

Most shared first

Code	Check	Used by
VER-022-F-01	Risk and incident response procedure	AI Act PL 2338 CRA DORA ISO 42001 NIS2 NIST AI RMF
VER-022-D-01	Serious incident reporting procedure	AI Act PL 2338 RGPD NIST AI RMF
VER-013-F-04	Communication to market surveillance authorities in the event of risk	AI Act PL 2338 Colorado AI Act
VER-032-G-03	Serious incidents documented and reported to the AI Office	AI Act AI Basic Act SB 53
VER-AUTO-01	Suspension procedure in the event of risk	AI Act DORA
VER-013-F-01	Documented non-conformity management procedure	AI Act ISO 42001
VER-013-F-02	Immediate notification of stakeholders in the event of non-conformity	AI Act
VER-013-F-03	Corrective actions traced and documented	AI Act
VER-032-G-05	Corrective measures for serious incidents documented	AI Act
NEW-GDPR-03	72-hour notification procedure to the DPA	RGPD
NEW-US-CO-02	90-day Attorney General reporting procedure	Colorado AI Act
NEW-DORA-01	DORA major incident reporting procedure	DORA

Related themes

Post-deployment monitoring Authorities & registration Third parties & value chain Intellectual property

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.