AI Control Library / CF-10: Recourse & Incident Response
Designation: Core | Control types represented: Operational
Control requirement
Classify AI incidents using defined categories and severity criteria reflecting actual and potential harm, scope, continuing activity, uncertainty and containment. Reassess classification as evidence changes.
Why this matters
A blocked unsafe suggestion and an executed unauthorized action require different responses. Classification must establish what is known and what could still occur without dismissing serious uncertainty.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
AI incidents, near misses and reports requiring response prioritization across security, quality, rights and operational effects.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The triage lead applies classification with system and domain expertise; the incident authority approves material changes.
Implementation guidance
- Define categories and severity factors covering people, information, finances, operations, autonomy and affected scope.
- Separate proposed behavior, attempted action, blocked activity and confirmed consequence in the record.
- Account for incomplete evidence and continuing exposure, using proportionate precaution rather than false certainty.
- Review severity after containment, new victims, expanded scope or improved evidence, retaining the reason for changes.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Classify representative scenarios | The criteria distinguish actual effect and potential continuing harm. |
| Review an uncertain report | Missing evidence and precautionary decisions are explicit. |
| Change the incident scope | Severity and response are reassessed with recorded rationale. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Category and severity criteria
- Scenario calibration
- Classification and revision history
- Response-priority decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate disputed or potentially severe classification to the incident authority. Apply justified containment while evidence is collected rather than waiting for perfect attribution.
Example in practice
Hypothetical example: A malicious document causes an agent to propose data export, but authorization blocks it. The record preserves the attempted misuse and checks other paths without falsely reporting a confirmed leak.
Related controls
- CF10-005: AI Incident Triage Process
- CF09-011: Agentic System Action Monitoring
- CF10-008: AI Incident Metrics & Reporting
Framework mappings
- CSA AICM (SEF-09)
- NIST AI RMF (MANAGE 3.1)
- EU AI Act (Art. 72)
- ISO 42001 (Cl. 10.2)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Recourse & Incident Response
Version 1.0