AI Incidents Belong in the Incident System You Already Trust
A verified operating read of AI incident definitions and reporting regimes: what counts as an incident, which events must leave the building and on whose clock, and what to build before a regulator specifies it.
It is safe to approve AI in consequence-bearing operations only if the sponsor can show the incident regime behind it: a written definition that turns on realized harm plus material AI contribution, separate internal categories for near misses and control failures, routing into the incident command system the enterprise already runs, and an evidence packet preserved before remediation changes the scene. A new AI portal, a policy binder, or a vendor dashboard does not satisfy this, and the AI label never pauses an existing reporting clock.
The operating regime
An AI incident is realized harm with material AI contribution. A near miss is the same pattern where intervention, redundancy, or chance prevented harm. A control failure is a safeguard that did not work.
All three classes flow into existing safety, cyber, reliability, privacy, legal, and disclosure incident command through a short AI addendum, not a parallel AI process.
Near misses and control failures report internally under protected good-faith rules, so the channel that punishes does not silence the channel that teaches.
External reports fire when the underlying event crosses an existing legal threshold or a defined serious-harm threshold, on the existing clock, to the named recipient.
Owner, briefing, proof
Owner
A named incident commander per event, plus standing owners for classification, evidence preservation, and each external reporting route. The AI label never moves ownership out of incident command.
Briefing
A one-page read per event: class, severity gates crossed, lane, applicable external thresholds and clocks, and the current causal confidence, updated as the picture changes.
Proof
The preserved evidence packet plus the staged record: initial facts, updates, root cause, corrective action, and the trend review that catches repeated low-level failures.
What leaders should take from it
The verified base definition turns on harm plus AI contribution: development, use, malfunction, or unauthorized behavior of AI that caused or materially contributed to realized harm. A wrong output with no consequence is a quality defect for the backlog, unless it recurs, aggregates, or exposes a failed control. Near misses and control failures get their own internal categories so the signal is captured without inflating the incident count.
Aviation's confidential reporting system shows that a protected voluntary channel surfaces near misses a punitive channel suppresses; grid, securities, and drug-safety regimes show the other lane: named recipients, triggering tests, deadlines, and follow-ups. Protect good-faith internal reports while preserving discipline for recklessness, concealment, or a missed mandatory report. The protection is conditional, not immunity.
The worked utility example: an AI-related cyber event that meets the NERC CIP-008 test goes to E-ISAC and CISA on the existing one-hour clock; a reliability event follows EOP-004 and the entity's Operating Plan; DOE's separate form runs its own faster tiered clocks through its own channel. One internal case drives every route. The AI label never pauses, restarts, or merges any of those clocks.
Internal reporting starts on a reasonable possibility that AI contributed to harm, an unauthorized action, a failed stop, compromised data or evidence, or a recurring pattern. External reporting starts when the underlying event meets an applicable legal threshold. The two triggers are intentionally different, and related low-severity events must be aggregated because a series can be material when no single event is.
Before remediation changes the scene, capture the system and model version, use case, inputs and context, tool calls, permissions, approvals and overrides, expected and failed controls, containment, and causal confidence. Then report in stages: fast initial facts, updates, a root-cause and corrective-action record, and a trend review. An event that cannot be reconstructed cannot support learning, disclosure, or assurance.
The verified base establishes the definitions, the current mandatory clocks, and the design pattern mature regimes share. Two things it does not establish. First, public incident databases measure documented reports, not the AI incident rate: the counts are voluntary, media-dependent, skewed toward high-visibility English-language cases, and lack any exposure denominator, so a rising count proves accumulation of documented cases, not a measured rise in harm. Second, the two-lane architecture rests on cross-regime analogy and a peer-reviewed design review, not on controlled evidence that any single reporting design reduces incidents. There is also an open institutional question the briefing names honestly: no one has yet built the protected cross-firm sharing layer that would let one enterprise's incident prevent another's.
The findings in full
The cleanest verified base definition: development, use, or malfunction of AI directly or indirectly leads to harm to health, critical-infrastructure disruption, violations of protected rights, or harm to property, communities, or the environment. The EU AI Act adds a serious-incident ceiling with a causal gate. Enterprise practice should add two categories law often misses: a near miss where harm was narrowly prevented, and a control failure where a stop, override, authorization, monitoring, data, or evidence control did not work. The deliberate consequence: a bad model output with no harm and no failed control stays in the quality backlog.
Aviation's confidential reporting system demonstrates that voluntary, protected reporting surfaces near misses a punitive channel suppresses; its sanction waiver is conditional and it never replaces mandatory duties. Grid, securities, and drug-safety regimes supply the accountability lane: defined recipients, triggering tests, deadlines, preliminary reports, and follow-ups. The enterprise version protects good-faith internal reports while preserving discipline for recklessness, deliberate misconduct, concealment, or failure to make a required external report.
The worked example, current as of July 2026: CIP-008-6 and EOP-004-4 are the mandatory NERC baselines. An AI-related cyber event meeting the CIP-008-6 criteria goes to E-ISAC and CISA on the existing one-hour clock after determination; a reliability event follows EOP-004-4 and the entity's Operating Plan; the DOE form uses its own faster tiered clocks through its own channel, and submitting it does not automatically notify every other required recipient. One internal case drives every route. Successor standard versions exist but were not yet in force at verification.
Internal reportability starts on a reasonable possibility that AI contributed to harm, a near miss, an unauthorized action, a failed stop or override, compromised data or model integrity, loss of evidence, or a recurring pattern. External reportability starts when the underlying event meets the applicable safety, reliability, cyber, privacy, employment, environmental, securities, or AI-law threshold. The two triggers are intentionally different, and related low-severity events must be aggregated: a series can be material when no single event is.
Before remediation changes the scene, preserve the system and model version, use case, inputs and retrieved context, prompts, tool calls, permissions, human approvals and overrides, affected assets and people, expected controls, observed failure, containment, vendor involvement, and causal confidence. Then report in stages: fast initial facts, updates as the picture changes, a root-cause and corrective-action record, and a trend review that catches repeated low-level failures across systems. An event that cannot be reconstructed cannot support learning, disclosure, or assurance.
First moves before hiring anyone
Incident means realized harm with material AI contribution. Near miss means harm prevented by intervention, redundancy, or chance. Control failure means a failed safeguard that could plausibly enable harm. Keep routine quality defects in the product backlog unless they aggregate, recur, or expose a failed control.
People or environmental safety; critical-service or operational disruption; cyber, data, or model integrity; legal, privacy, employment, or rights impact; financial or investor materiality; unauthorized autonomy, failed stop, irreversibility, or cross-site propagation.
System and model version, use case, owner, vendor, inputs and context, tools and actions, permissions, approvals, override state, affected assets and stakeholders, expected and failed controls, evidence-preservation status, containment, causal confidence, and every applicable reporting clock. A field set is a sprint; a parallel AI portal is a mistake that splits ownership and clocks.
Immediate operational escalation; a named incident commander and legal triage within one hour for severe events; a preliminary evidence packet within four hours; an initial enterprise record within 24 hours. These are internal targets. The external clock stays whatever the applicable reliability, cyber, disclosure, privacy, safety, or AI law requires.
For a NERC-registered utility that means mapping E-ISAC, CISA, the reliability regulator and Regional Entity, the Reliability Coordinator, the DOE Operations Center, the state commission, law enforcement, securities disclosure, and privacy authorities against each AI use case. Other regulated industries substitute their own recipients; the matrix discipline is the same.
Run one tabletop with three scenarios: an unsafe AI recommendation rejected by an operator, an agent acting outside its authorization, and a vendor model compromise. Measure time to classify, evidence completeness, clock identification, stop authority, recipient accuracy, update quality, corrective-action closure, and recurrence.
Start with one tabletop: run an unsafe AI recommendation, an out-of-authorization agent action, and a vendor model compromise through the incident command you already have, and score time to classify, evidence completeness, and recipient accuracy. If the gaps are material, widen to a definition, trigger, and routing review across the AI portfolio. Build the full regime, protected lane included, only when the sponsor wants it run.
Claim ledger
- The EU Digital Omnibus publishes in the Official Journal, or the European Commission finalizes its serious-incident guidance and reporting template, changing Article 73 timing or content.
- FERC approves the successor event-reporting standard, NERC changes an implementation date, or the next cyber-incident standard version is accelerated; the routing example then needs re-verification.
- DOE replaces the current disturbance-reporting form or resolves its known wording inconsistencies.
- A standards body, regulator, or information-sharing organization publishes a common AI incident taxonomy, severity scale, or protected sharing protocol.
- A regulator or court decides how much AI contribution triggers causation, materiality, disclosure, or liability.
- A controlled or audited multi-enterprise study shows protected near-miss reporting reduces recurrence, or that reporting burden overwhelms signal.
- A serious AI-related utility or industrial incident exposes missing evidence, failed routing, or an ineffective human override in practice.