Communication of incidents

Work out and write down how incidents will be communicated to the people using the AI system. In practice the record is incident communication plan for users of the AI system. For communication of incidents the test is what a reader outside the team understands.

What it asks

Work out and write down how incidents will be communicated to the people using the AI system.

Where generative AI changes the answer

Incident communication has to reach the people affected by a bad output, who may not be the system's users.

Who it binds

The AI system owner and the communications or customer function. For A.8.4 the named role is the owner of incident communication plan for users of the AI system.

Evidence an auditor normally samples

• Incident communication plan for users of the AI system
• Analysis of notification obligations (incident types, timelines, authorities, required details) including AI-specific cases such as PII breaches in training data
• Integration with organizational incident management

The test you can run

Compare incident communication plan for users of the AI system with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Plan covers regulators but not users
• AI-specific notification requirements not analysed

Before the draft publishes

For A.8.4, read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features. The first artefact to produce is incident communication plan for users of the AI system.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.8.4 (communication of incidents) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.