AI Control Library / CF-10: Recourse & Incident Response
Designation: Core | Control types represented: Governance and Operational
Control requirement
Assess and perform applicable AI incident and personal-data breach notifications through authorized processes, identifying recipients, triggers, timing, required content and follow-up. Record reasons for notification and non-notification decisions.
Why this matters
Incomplete early evidence does not remove the need to assess reporting duties. Notifications must be timely and accurate, distinguishing confirmed facts from uncertainty and updated information.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
AI incidents potentially subject to legal, regulatory, contractual or affected-party notification requirements, according to actual roles and circumstances.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The incident authority coordinates legal, privacy, compliance, communications and relevant business owners.
Implementation guidance
- Identify applicable duties, roles, recipients and timing triggers through qualified review, distinguishing monitoring duties from incident reporting requirements.
- Track awareness and relevant decision times, prepare required information and preserve the basis for conclusions.
- Use verified contacts and secure approved channels, delivering initial and subsequent information as required without unsupported impact claims.
- Retain submissions and acknowledgements, revisit decisions as evidence changes and coordinate supplier inputs without assuming they discharge the organization’s own duties.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Exercise a reportable scenario | Qualified owners identify recipients, timing and required information. |
| Review an uncertain early incident | The reporting assessment proceeds with documented known facts and gaps. |
| Trace a submission | Approval, delivery and required follow-up are evidenced. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Notification requirement and contact matrix
- Awareness and decision timeline
- Approved notices and acknowledgements
- Follow-up and non-notification decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate uncertain duties or approaching obligations to legal and incident authorities immediately. Use the required reporting route and reviewed interim information rather than waiting automatically for a complete investigation.
Example in practice
Hypothetical example: A supplier reports possible exposure before it knows the full scope. The customer assesses its own duties and prepares a factual initial notification where required, updating it as findings develop.
Related controls
- CF10-007: Regulatory & Authority Contact Maintenance
- CF05-018: AI Data Sub-processing Controls
- CF04-016: AI Governance Evidence Management
Framework mappings
- NIST AI RMF (MANAGE 3.1)
- EU AI Act (Art. 72, Art. 73)
- GDPR (Art. 33)
- ISO 42001 (Cl. 10.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Recourse & Incident Response
Version 1.0