Skip to main content
    Incidents & Monitoring
    5 min readUpdated 2025-01-24

    Incident Management Overview

    How to log, track, and respond to AI-related incidents using Klarvo's incident management system.

    Incident Management

    For high-risk AI systems, deployers must monitor operation and report serious incidents. Klarvo's incident management helps you track, respond to, and document AI-related incidents.

    What Counts as an Incident?

    AI incidents requiring documentation include:

  1. Safety events: Physical or psychological harm
  2. Rights violations: Discrimination, privacy breaches
  3. Performance failures: Unexpected outputs, hallucinations
  4. Security events: Data leaks, unauthorized access
  5. Compliance gaps: Discovered non-conformities
  6. User complaints: Documented concerns about AI behavior
  7. Incident Severity Levels

    LevelDescriptionResponse Time
    CriticalImmediate harm, safety risk, prohibited practice< 24 hours
    HighSignificant impact, rights violation< 48 hours
    MediumModerate impact, contained< 1 week
    LowMinor issue, no harm< 2 weeks

    Incident Workflow

    Detection → Logging → Triage → Containment → Investigation
    

    ↓ ↓

    Notify Resolution

    ↓ ↓

    Internal teams Postmortem

    ↓ ↓

    Provider (if needed) Reassessment

    ↓ ↓

    Authority (if serious) Closure

    Required Documentation

    Each incident record should capture:

    Basic Information

  8. Title and description
  9. Linked AI system
  10. Severity level
  11. Status (Open, Investigating, Resolved)
  12. Timeline

  13. When it occurred
  14. When detected
  15. When contained
  16. When resolved
  17. Impact Assessment

  18. Affected parties
  19. Harm description
  20. Scale of impact
  21. Response Actions

  22. Containment measures taken
  23. Internal notifications sent
  24. External notifications required
  25. Resolution

  26. Root cause analysis
  27. Resolution actions
  28. Preventive measures
  29. Serious Incident Reporting

    Under Article 26(5), deployers must report serious incidents to:

  30. The AI system provider — Immediately
  31. Market surveillance authority — Within required timeframe
  32. A "serious incident" includes:

  33. Death or serious damage to health
  34. Serious/irreversible disruption of critical infrastructure
  35. Serious and irreversible environmental damage
  36. Serious violation of fundamental rights
  37. Integration with Reassessment

    Incidents can trigger system reassessment:

  38. Critical incidents → Automatic reassessment flag
  39. Patterns of medium incidents → Recommended review
  40. Resolved incidents → Documented in system history
  41. Best Practices

    🚨 Log immediately: Don't wait to document
    📞 Notify early: Err on the side of over-communication
    🔍 Root cause: Always dig to underlying issues
    📝 Postmortem: Learn and prevent recurrence
    🔄 Update procedures: Improve based on learnings