The European Artificial Intelligence Regulation has identified the reporting of serious incidents as one of the key responsibilities associated with high-risk AI systems. However, fulfilling this obligation is not merely a matter of reporting that an incident has occurred. It also requires having sufficient information to reconstruct what happened, assess its consequences and prevent it from happening again.
It is against this backdrop that the project ISO/IEC 25870 – Information technology — Artificial intelligence — Data elements for reporting AI system incidents . This standard aims to standardise the information used to document incidents in AI systems and facilitate a more consistent, traceable response geared towards organisational learning.
From AI incidents to organisational learning: the relationship between the AI Regulation and ISO/IEC 25870
As artificial intelligence systems become involved in decisions with real-world consequences, incident management is no longer purely a technical matter. A model error, an unexpected degradation, data corruption or a harmful automated decision may require the coordinated involvement of AI specialists, quality assurance managers, legal teams and governing bodies.
Article 73 of Regulation (EU) 2024/1689 stipulates that providers of high-risk AI systems must report serious incidents to the market surveillance authorities of the Member States in which they have occurred. This obligation applies to events with particularly significant consequences, such as serious harm to health, disruptions to critical infrastructure, infringements of fundamental rights, or serious damage to property or the environment.
The AI Regulation therefore sets out when an incident must be reported, who is responsible for doing so, and to which authority. However, in order to comply properly with this obligation, organisations also need to determine what information they must record and how they should structure it.
ISO/IEC 25870 as a future common language
ISO/IEC 25870 is being developed with the aim of defining a common set of data elements for reporting incidents involving AI systems.
Its intended purpose is not to impose new legal obligations, but to provide a consistent description of incidents. The future standard could help to structure information on the system affected, its purpose and context of use, the version of the model, the data or components involved, the outcomes produced, the individuals or processes affected, the causes identified and the corrective measures taken.
The relationship between the two instruments would therefore be complementary. The AI Regulation sets out the obligation to report certain serious incidents, whilst ISO/IEC 25870 could help ensure that the information used in such reports is comprehensive, comparable and reusable.
This complementarity would also mean that individual organisations would not have to define their own incident reporting format from scratch. A shared vocabulary and structure would facilitate communication between suppliers, those responsible for deployment, the authorities, auditors and other stakeholders in the value chain.
An incident with various dimensions
Let’s consider a machine vision system used to determine whether an industrial component passes a quality control check. Following an update, the model’s performance deteriorates and the system begins to accept defective components.
The first step would be to determine whether the event qualifies as a serious incident under the AI Regulations. To do this, it would be necessary to analyse its consequences, the people or infrastructure potentially affected, and the possible causal link to the system.
However, the investigation should not be limited to determining whether there is an obligation to report. It would also be necessary to identify which version of the model was in use, what changes were made, what data was used, how the metrics evolved, what erroneous decisions were made and which controls failed.
Once published, ISO/IEC 25870 could provide a common framework for structuring this second layer of information. In this way, the data collected would not only be used to report to the competent authority, but also to improve the system and retain evidence of the decisions taken during the management of the incident.
The link to the Cyber Resilience Act
Some AI incidents may also have a cybersecurity dimension. If the system disruption is due, for example, to the exploitation of a vulnerability in the update mechanism, the same event could trigger the notification obligations under the Cyber Resilience Act.
The Cyber Resilience Act and the AI Regulation do not necessarily regard the same events as serious. The former focuses on actively exploited vulnerabilities and incidents affecting the security of products containing digital components. The latter addresses serious consequences arising from the operation of certain AI systems.
The future information framework proposed by ISO/IEC 25870 could help link these two analyses through a common incident record. This would help reduce duplication and avoid contradictions between the information managed by the cybersecurity, compliance, quality and artificial intelligence teams.
Report to learn
Incident management should not end with the submission of a report to the relevant authority. A well-structured report must make it possible to reconstruct what happened, preserve evidence, analyse the causes and verify the effectiveness of corrective measures.
The combination of the AI Regulation with the future ISO/IEC 25870 standard could transform incident reporting into a genuine organisational learning capability. The Regulation would provide the legal framework and criteria for determining which incidents must be reported. The draft standard aims to provide a common structure for documenting these incidents and to utilise the results of their analysis for the continuous improvement of the system.
Ultimately, the key issue centres on having the necessary information to understand the incident. The AI Regulation sets out the responsibility for reporting serious incidents. Once finalised, ISO/IEC 25870 could help ensure that such reporting is traceable, technically useful and aimed at preventing a recurrence.
NOTE: ISO/IEC 25870 is still under development, so its content may change before its final publication.