Requirement
"The organization shall determine and document a plan for communicating incidents to users of the AI system."[1]
Explanation
When something goes wrong with an AI system — a failure, a breach, unsafe behavior — users may need to be told, sometimes within legally mandated timelines. Auditors expect a documented communication plan covering which incident types trigger notification, how fast, to whom, including authorities, and what details each notice must contain.
Implementation Guidance
- Incidents related to the AI system can be specific to the AI system itself, or related to information security or privacy (e.g. a data breach). The organization should understand its obligations around notifying users and other interested party about incidents, depending on the context in which the system operates. For example, an incident with an AI component that is part of a product that affects safety can have different notification requirements than other types of systems.
- Legal requirements (such as contracts) and regulatory activity can apply, which can specify requirements for:
- types of incidents that must be communicated;
- the timeline for notification;
- whether and which authorities must be notified;
- the details required to be communicated.
- The organization can integrate incident response and reporting activities for AI into their broader organizational incident management activities, but should be aware of unique requirements related to AI systems, or individual components of AI systems (e.g. a PII data breach in training data for the system can have different reporting requirements related to privacy).
- Other information: ISO/IEC 27001 and ISO/IEC 27701 provide additional details on incident management for security and privacy respectively.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.8.4
- ISO/IEC 42001:2023 Annex B, B.8.4 (implementation guidance)
