Checks / Obligations / Handle and report incidents
Obligation · 19 controls · 11 laws
Handle and report incidents
Incidents must be detected, handled, learned from and reported to authorities on time.
What to put in place
Write an incident procedure with reporting deadlines, practise it and record every incident.
Policy wording you can use
[your organisation] has a documented procedure to detect, handle and learn from incidents, reports serious incidents to the relevant authorities within the legal deadlines, and records every incident.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 17 controls here that take a yes or a document (the rest need their own number or date and are listed after).
Every control that asks for this
DORA
- DORA Art.13 - learning & evolving process
- DORA Art.14 - crisis communication plan
- DORA Art.17 - incident management process
- DORA Art.19 - major incident reporting path
EU AI Act
- EU AI Act Art.73 - serious-incident reporting path
- EU AI Act Art.55 - GPAI serious-incident tracking
- EU AI Act Art.73 - serious incidents reported within 15 days
EN 18286:2026 (AI Act QMS)
- EN 18286 Cl.9.6 / Art.17(1)(i) - serious incident reporting procedure
- EN 18286 Cl.9.6 - serious incident reported within 15 days