# A.8.4 Communication of incidents

Work out and write down how incidents will be communicated to the people using the AI system. In practice the record is incident communication plan for users of the AI system. For communication of incidents the test is what a reader outside the team understands.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.8.4
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Work out and write down how incidents will be communicated to the people using the AI system.

## Where generative AI changes the answer

Incident communication has to reach the people affected by a bad output, who may not be the system's users.

## Who it binds

The AI system owner and the communications or customer function.

## Evidence an auditor samples

- Incident communication plan for users of the AI system
- Analysis of notification obligations (incident types, timelines, authorities, required details) including AI-specific cases such as PII breaches in training data
- Integration with organizational incident management

## The test you can run

Ask a customer-facing colleague to explain the system limits. Compare that with the published statement.

## Common failures

- Plan covers regulators but not users
- AI-specific notification requirements not analysed

## Before the draft publishes

Read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.