Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A useful AI incident file lets someone who was not present reconstruct the system involved, the event and its timeline, the evidence available, the organization’s assessment and response, and any notifications. For EU providers of high-risk AI systems, the AI Act also sets serious-incident reporting duties and deadlines. The checklist below is a practical way to organize evidence—not a regulator-issued universal form—and the applicable rules depend on the system, the organization’s role, and the jurisdiction.
First, identify which reporting regime applies
Do not treat every AI-related failure as subject to the same reporting rule. The EU AI Act distinguishes among providers of high-risk AI systems, deployers of those systems, and providers of general-purpose AI (GPAI) models with systemic risk. Their duties differ. Other laws, including sectoral, privacy, product-safety, cybersecurity, state, national, and contractual requirements, may also apply.
As an Amazon Associate I earn from qualifying purchases.
Providers of high-risk AI systems
Article 73 requires a provider to report a serious incident involving a high-risk AI system to the relevant market-surveillance authorities. The reporting trigger is when the provider establishes a causal link between the system and the serious incident, or a reasonable likelihood of such a link. The provider should report promptly after that trigger; the specified maximum periods are measured from awareness of the incident, including awareness by a deployer where applicable.
Deployers of high-risk AI systems
Deployers have duties to monitor operation, keep certain logs under their control, and inform the provider or relevant parties when they identify a serious incident or risk, as applicable to their role and the Act. Article 73’s provider reporting deadlines should not be misread as a general deadline for every deployer or every AI event.
Providers of systemic-risk GPAI models
This is a separate regime, not simply another name for the high-risk-system process. The European Commission says systemic-risk GPAI providers must track, document, and report relevant serious-incident information and possible corrective measures without undue delay to the AI Office and, as appropriate, national competent authorities. Relevant incidents can include serious cybersecurity breaches involving the model or its physical infrastructure, such as model-parameter exfiltration or cyberattacks, when pertinent to the Act’s systemic-risk duties.
What to put in the incident file
The EU AI Act does not prescribe one combined incident-file checklist or a single file format. The following structure is a practical evidence set inferred from the duties to log, assess, investigate, correct, report, and cooperate. Keep original evidence and decision records linked to the file, with access controls appropriate to the information they contain.
1. System identity and operating context
- System name, version, relevant model or component versions, configuration, and the provider and deployer.
- Intended purpose and the actual deployment context: the workflow, users, affected process, and how outputs were used.
- Relevant changes before or during the event, such as a software or model update, configuration change, new data source, changed instructions, or altered human-review process.
- Known limitations or operating conditions relevant to the event.
These details help establish which system state is under examination. The Act’s traceability rationale includes characteristics, capabilities, limitations, development, testing, validation, and risk management; a bare product name may not identify the configuration that produced an outcome.
Rank #2
2. Incident record and timeline
- When the incident occurred, when it was detected, and when each relevant person or organization became aware of it.
- What happened, what outcome was observed, and which people, services, or processes were affected.
- A chronological record of alerts, human decisions, escalation, containment, and communications.
- The source of each observation, such as a system log, user report, monitoring alert, or investigator finding.
- A severity assessment, the criteria used, and any material uncertainty.
Mark what is directly observed separately from inference or hypothesis. Record conflicting accounts rather than silently resolving them, and preserve the timestamps and time zone used by each source.
3. Preserved technical evidence
- Relevant automatically generated logs and monitoring signals, along with the system, version, and configuration state they describe.
- Input and output records needed to understand the event, where their retention and use are lawful.
- Records of access, export, transfer, or alteration of evidence, including who handled it and when.
- Evidence limits: missing logs, clock differences, unavailable inputs, retention gaps, or other reasons a record may not be complete.
For high-risk AI systems, Article 12 requires technical capability for automatic event logging over the system’s lifetime, supporting risk identification and post-market and operational monitoring. A specific minimum-log-fields rule applies to certain Annex III point 1(a) law-enforcement systems: Article 12 identifies each use’s start and end, the reference database, matched input data, and the human verifiers. That specialized rule is not a universal field list for every AI system.
4. Assessment and investigation
- The suspected connection between the AI system and the incident, including whether a causal link is established, reasonably likely, suspected, or not supported by current evidence.
- Alternative explanations considered and the evidence for or against each material possibility.
- Investigation steps, findings, open questions, and the limits of the available evidence.
- The risk assessment, including potential impact, scope, and whether similar deployments or users may be exposed.
Keep the assessment time-stamped and distinguish preliminary conclusions from confirmed findings. Under Article 73, the provider must investigate without delay after reporting, including a risk assessment and corrective action, and cooperate with competent authorities.
Rank #3
5. Response, corrections, and validation
- Immediate containment or mitigation, who authorized it, when it took effect, and what exposure remained.
- Rollback, model or system changes, or other corrective measures, with the reasons for choosing them.
- Validation or monitoring after a change, the results, and any remaining risks or restrictions.
- Decision records showing why an action was taken or deferred and who was responsible.
Article 73 requires the provider to cooperate with authorities and cautions against changing the system in a way that could affect evaluation of the cause before informing authorities of that action. Preserve the pre-change state and explain the proposed change when authority notification is required.
Recommended Free Tools
6. Notifications and follow-up
- Who was notified, in what role, when, by what channel, and what information was sent.
- Copies of initial and follow-up reports, regulator requests, responses, and cooperation records.
- Any known gaps in an initial submission and the plan for supplying the missing information.
Article 73 permits an initial incomplete report followed by a complete report. The file should make clear which submission was preliminary and what was added later. For systemic-risk GPAI providers, track and document the serious-incident information and possible corrective measures reported to the AI Office and, where appropriate, national authorities.
7. Retention, access, and confidentiality
- The organization’s role and the legal basis for retaining each record.
- Applicable retention period, access permissions, and any privacy, security, or confidentiality restrictions.
- Where evidence is held, who can retrieve it, and how a lawful preservation or regulator request will be handled.
Set a retention period for each class of record rather than applying one number to the entire file. The specific EU periods are different: Article 26 addresses deployer-controlled logs, while Article 18 addresses enumerated provider compliance documentation.
EU serious-incident reporting deadlines for high-risk systems
Under Article 73, the provider reports promptly once the causal-link or reasonable-likelihood trigger is met, subject to these maximum periods after awareness:
| Case | Maximum period | How to read it |
|---|---|---|
| General serious incident | 15 days | Article 73(2); the outer limit runs from awareness by the provider or, where applicable, the deployer. |
| Specified widespread infringement or serious incident | 2 days | Article 73(3); immediate reporting is required, with two days as the maximum. |
| Incident involving a death | 10 days | Article 73(4); report immediately after a causal link is established or suspected, with ten days after awareness as the maximum. |
These are EU AI Act time limits for the applicable high-risk-system provider reporting duty, not universal deadlines for every organization or jurisdiction. The provider must investigate without delay after reporting, and an incomplete initial report may be followed by a complete one.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDo not confuse the two AI Act retention periods
At least six months for certain deployer-held logs
Article 26(6) requires high-risk AI deployers to keep automatically generated logs under their control for a period appropriate to the system’s intended purpose and at least six months, unless applicable Union or national law provides otherwise. It concerns deployer-controlled logs, not every incident-related record in every organization.
Ten years for specified provider compliance documents
Article 18 requires high-risk AI providers to keep listed compliance documentation available to national competent authorities for ten years after the system is placed on the market or put into service. The listed materials include technical documentation, quality-management documentation, certain notified-body records, and the EU declaration of conformity. This is not a blanket ten-year retention rule for all incident data.
How to make the file useful before an incident
- Assign ownership. Name who opens the file, who preserves logs, who assesses severity and reporting triggers, and who can approve regulator communications.
- Map evidence to systems. Make system and version identifiers available in operational logs so an incident can be tied to the relevant deployment and configuration.
- Preserve records promptly. Define lawful, secure ways to retain relevant logs and inputs, record evidence handling, and flag known gaps rather than assuming every source is complete.
- Use a dated decision trail. Record when awareness, escalation, causal assessment, containment, and reporting decisions occur; these timestamps matter to the applicable response and reporting process.
- Keep regimes separate. Label whether a record concerns a high-risk AI system provider, a deployer, or a systemic-risk GPAI provider, and check other applicable obligations rather than assuming the AI Act is the only one.
The practical difficulty is that AI behavior is tied to its deployment context, data, and model components. A Carnegie Mellon University Software Engineering Institute presentation by Violet Turri at the NIST Workshop on AI Incident Management, dated May 14, 2026, highlights context, lifecycle events, and explainability as documentation challenges. The presentation is useful operational context, not a legal template; its opinions should not be treated as an official U.S. Government position. Suggestions such as centralized reporting or proactive system registries are proposals, not current requirements established by the cited EU provisions.
What this means outside the EU
The requirements and timelines above are EU-focused. They should not be presented as a worldwide AI incident standard. The cited materials do not establish a comparable single U.S.-wide mandatory AI incident-file template; that does not mean no U.S. obligations exist. Depending on the system and event, sectoral, state, privacy, product-safety, cybersecurity, or contractual rules may impose separate duties. Identify the relevant jurisdictions and organizational roles before applying the EU checklist or deadlines.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
