serious-incident-reporting

What it does

Determines if an event qualifies as a serious incident under Article 3(49) of the EU AI Act, then prepares a practical response plan, including a draft Article 73 incident report, internal action list, and an incident playbook. It covers identifying the right market surveillance authority, managing 2/10/15-day deadlines, and aligning with GDPR, NIS2, MDR, and other regimes. It supports building an internal incident playbook, escalation matrix, and management briefing.

How it works

Follows Core Workflow Step 1 through Step 7:

• Step 1: Confirm Scope whether the AI system is high-risk under Article 6(1)/(2)/(3).
• Step 2: Qualify the event as a serious incident per Article 3(49) using a decision tree (high-risk existence, harm, causal link).
• Step 3: Determine the correct deadline bucket (2, 10, or 15 days) and applicable rules under Article 73(2)-(5).
• Step 4: Identify the recipient authority based on location and cross-border considerations; include Germany-specific routing where relevant (BNetzA, BaFin, BSI, etc.).
• Step 5: Build the reporting package with sections for provider/AI system, incident facts, impact, causation, containment, evidence, parallel notifications, and planned follow-up; reference a practical template.
• Step 6: Apply Article 26(5) duties for deployers if applicable, including evidence preservation and timely notifications.
• Step 7: Map overlapping legal regimes (GDPR, NIS2, MDR, product safety) to ensure parallel reporting where required.

When to use it

Use when the user wants to assess whether an AI incident is reportable under Article 73, draft an Article 73 incident report, build an incident playbook, handle an AI failure or bias/discrimination incident, identify the correct market surveillance authority, manage 2/10/15-day deadlines, or handle a schwerwiegender Vorfall under the EU AI Act.

What it can touch

The skill references and relies on tools to produce a qualification memo, deadline assessment, recipient map, draft Article 73 incident report, cross-regulation matrix, internal action checklist, and a management briefing. It uses the provided templates and reference materials to structure outputs.

Caveats

The skill specifies procedural steps and required content but does not guarantee regulatory outcomes; it guides judgment based on Step-by-step rules and reference materials. It assumes the event involves a high-risk AI system under Article 6 and that the user seeks formal notification artifacts and cross-regulatory alignment.