Back to the AI Control Library
13 controls | 12 core | 1 supplemental
Why this family matters
When AI causes harm or fails unexpectedly, the organization needs a way to contain the problem and a way for affected people to obtain a response. This family brings incident management and decision recourse together. It addresses both operational recovery and the responsibility to investigate, communicate and remediate consequences.
What this family covers
The controls cover incident policies, severity classification, response plans, exercises, triage, notifications, authority contacts, reporting, recourse, post-incident learning and harm remediation. Supply-chain incidents and incident service management are also included.
How the four control types apply
Operational controls organize triage, containment, notification, recourse and recovery. Technical mechanisms support detection, isolation and restoration. Governance controls establish applicable external reporting and remedy obligations. Contextual considerations shape how affected people learn about a problem and access a response.
Where to begin
Define what counts as an AI incident, establish reporting and escalation paths, and give affected people an accessible way to challenge consequential outcomes.
Controls in this family
This family contains 13 controls: 12 core and 1 supplemental. Each page provides requirements, implementation steps, verification criteria, evidence, escalation and a worked example. Applicability depends on the system, information and risks involved.
Core controls
- CF10-001: AI Incident Management Policy & Procedures
- CF10-002: AI Incident Category & Severity Classification
- CF10-003: AI Incident Response Plans
- CF10-004: AI Incident Response Testing & Exercises
- CF10-005: AI Incident Triage Process
- CF10-006: AI Incident & Breach Notification
- CF10-007: Regulatory & Authority Contact Maintenance
- CF10-008: AI Incident Metrics & Reporting
- CF10-009: AI Decision Recourse Mechanism
- CF10-010: AI Post-Incident Review & Learning
- CF10-011: AI Harm Remediation
- CF10-012: AI Supply Chain Incident Response
Supplemental controls
Applying this family
Prepare response authority, evidence and containment before an incident. Distinguish observed effects from proposed or blocked actions and preserve uncertainty as investigation develops. Coordinate notification, supplier response and recovery, then address affected people and outcomes separately from technical restoration. Recourse must reach a person with meaningful review authority.
Version 1.0