Platform
AI incident management, from first report to final report
Aicura's AI incident management gives every AI incident one place, linked to the systems and agents involved. Raise it, triage it, log the response, decide who has to be told and close it with lessons and a final report. Each step is recorded as it happens, not pieced together afterwards.
Included in Pro and Enterprise. Compare plans
The lifecycle
One workflow for every AI incident
A customer sends a screenshot of your chatbot contradicting your own policy guidance. That is a customer issue, a model behaviour issue and possibly something you have to report, all at once, and it rarely fits the incident process you already run. Aicura gives the incident a home before you need one, connected to every system or agent involved.
Raise it and triage it
An incident can start from a staff report, a customer complaint, a monitoring alert or a vendor's notice of a model change. Raising it names the systems and agents involved on the register, so from the first minute it is linked to their owners, versions and everything else Aicura holds about them. Guardian, the part of Aicura that responds when monitoring spots a problem, can open an incident itself, but only as far as you have allowed.
- Category from seven, including agentic misbehaviour and third-party model change.
- Severity and outcome, recorded as actual, near miss or averted.
- Individuals affected and the types of impact.
Log the response as it happens
The response log takes each action, decision and communication as it happens, with who recorded it and when. Rollbacks, vendor contact, customer outreach and internal updates sit in one timeline that builds as the work goes on.
While the incident is open, the rest of Aicura is still to hand. Suspend an agent at the AI gateway its traffic passes through, switch on a stricter set of guardrails or put the system back under review.
Decide who needs to know
The people and bodies you may have to tell, such as a regulator, are set up once as recipients, each with the criteria for when it applies. When an incident reaches the notify step, every recipient is listed and your team marks each as applying or not, with a rationale.
- Notification drafts as a starting point for judgement, never an instruction to send.
- Lodgement and acknowledgement recorded against each recipient.
Close it with lessons and a report
Lessons are captured with an owner each, so a review of vendor change management or a monitoring improvement has someone accountable for it. A final report closes the incident.
The Incident report sets out one incident's timeline through to closure, the linked system and any notification drafts. It carries your organisation's branding and stays available for the audit committee, the board or a regulator's follow-up. The significant moments of the incident are saved as snapshots in the Evidence Vault.
Notification pathways
The process is the same everywhere. Who you tell depends on where you operate.
Each notification pathway is a recipient with its own criteria. Your team decides at the time of the incident whether it applies. Whether an incident meets a threshold, and whether to notify, are decisions your organisation makes with its advisers.
Australia
- OAIC, APRA and ASD notificationsPro
New Zealand
- Privacy Commissioner notificationsPro
India
- CERT-In notificationsPro
Sri Lanka
- Central Bank of Sri Lanka notificationsPro
Singapore
- PDPC, MAS and CSA notificationsPro
Malaysia
- PDP Commissioner and NACSA notificationsPro
Hong Kong
- Critical infrastructure Commissioner notificationsPro
United Arab Emirates
- DIFC Commissioner notificationsPro
Saudi Arabia
- SDAIA notificationsPro
Qatar
- QFC Data Protection Office notificationsPro
South Africa
- Information Regulator notificationsPro
Nigeria
- NDPC notificationsPro
Kenya
- Data Commissioner notificationsPro
Ghana
- Data Protection Commission and CERT-GH notificationsPro
Jamaica
- Information Commissioner notificationsPro
United Kingdom
- Information Commission and NIS notificationsPro
Norway
- Datatilsynet notificationsPro
Switzerland
- FDPIC, BACS and FINMA notificationsPro
European Union
- Data protection authority notificationsPro
- EU AI Act serious incident notificationsPro
- NIS2 notificationsPro
United States
- Federal and state regulator notificationsPro
Canada
- Privacy Commissioner, CAI and OSFI notificationsPro
Questions
What counts as an AI incident?
An AI incident is any event where an AI system or agent caused harm or could have. Examples are a wrong decision that affected a person, an agent acting outside what it is allowed to do, personal information exposed through a model, or a vendor's model change that broke something downstream. If your team is asking whether it counts, record it and let triage decide. Near misses and averted incidents are recorded as outcomes too.
Does Aicura decide whether we have to notify a regulator?
No. In Aicura, each possible recipient, such as a regulator, carries the criteria for when it applies, and your team marks it as applying or not, with a rationale, at the time of the incident. Notification drafts are a starting point for judgement, not an instruction to send. Aicura provides guidance, not legal advice.
Which notification pathways are available?
Each country Aicura sells in has its own notification pathways, such as the OAIC, APRA and ASD in Australia, the Information Commission in the United Kingdom and data protection authorities and EU AI Act serious incident reporting in the European Union. They are listed below by country. The incident lifecycle itself is the same whichever pathways apply.
Can monitoring open an incident on its own?
Only if you allow it. Guardian is the part of Aicura that responds when monitoring spots a problem, and opening an incident is one of the things it can do when a condition you set is met. You decide how far it can go, from telling you and stopping to acting only with a named approver's sign-off, so an incident is opened only as far as you have allowed.
What is kept after an AI incident closes?
In Aicura, a closed incident keeps its triage, response log, decisions on who to notify, notification drafts, lodgements, lessons and final report, linked to the AI systems involved. The Incident report sets out the timeline through to closure, and the significant moments are saved as fixed snapshots in the Evidence Vault.
Have the process before the incident
Incidents are part of Pro. The middle of an incident is the wrong time to work out the process, so see how it runs before you need it.