Rapport d'incident IA

Qu'est-ce que Rapport d'incident IA?

Article 73 of the EU AI Act requires providers of high-risk AI systems to report serious incidents to market surveillance authorities within strict deadlines, and deployers must inform the provider and the authority. In this exercise, you investigate an AI-powered customer onboarding system that has been rejecting applicants from specific regions, determine whether the anomaly meets the Article 73 threshold for a serious incident, contain the damage, file the report, and resist vendor pressure to delay.

Ce que vous apprendrez dans Rapport d'incident IA

• Identify what constitutes a 'serious incident' under the EU AI Act and when Article 73 requires reporting
• Appliquer le bon ordre de réponse : contenir, enquêter/signaler, corriger
• Comprendre les délais de reporting pour les fournisseurs et les déployeurs de systèmes d'IA à haut risque
• Reconnaître et résister aux pressions visant à retarder la déclaration obligatoire des incidents
• Documenter avec précision les incidents liés à l'IA pour les soumettre aux autorités de surveillance du marché

Rapport d'incident IA — Étapes de la formation

1. Article 73 : Signalement des incidents graves

   Under Article 73 of the EU AI Act, providers of high-risk AI systems must report 'serious incidents' to the relevant market surveillance authority, and deployers must inform the provider and the authority (Article 26(5)). Article 3(49) defines a serious incident as an incident or malfunctioning that directly or indirectly leads to death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of obligations under Union law protecting fundamental rights, or serious harm to property or the environment. Reporting timelines are strict, and providers and deployers have distinct obligations. Today, one of your company's AI systems has triggered exactly this scenario.

2. Une escalade de support urgente

   Alice reçoit un e-mail urgent de l'équipe de support client. Ils ont signalé une tendance inquiétante dans le système OnboardAI, l'outil d'intégration des clients de l'entreprise, alimenté par l'IA.

3. Vérification du tableau de bord IA

   Alice ouvre le tableau de bord de surveillance de l'IA pour confirmer l'anomalie avec des données concrètes. Le tableau de bord suit toutes les mesures du système d'IA, y compris les taux d'approbation, les alertes et les coûts opérationnels.

4. Confirmation de l'anomalie

   Le tableau de bord confirme ce que le support client a signalé. L’alerte critique montre un schéma clair et systématique de discrimination régionale de la part du système OnboardAI.

5. Est-ce un incident à signaler ?

6. Confinement immédiat

   The data is clear. Now Alice must determine: does this meet the threshold for a 'serious incident' under Article 3(49)? The answer is yes. Systematic discrimination affecting 230 applicants constitutes a potential breach of the right to non-discrimination - a fundamental right protected under EU law. Key factors that make this reportable: Systematic pattern: Not a random error, but a consistent 0% approval (100% rejection) rate sustained over 7 days Fundamental rights impact: The right to non-discrimination is a protected fundamental right Significant scale: 230 people denied access to services based on their region Ongoing harm: The system is still actively rejecting applicants right now Under Article 3(49), a serious incident includes an incident or malfunctioning that directly or indirectly leads to an infringement of obligations under Union law intended to protect fundamental rights. Regional discrimination in access to services qualifies clearly. Before investigating the root cause or filing a formal report, the first priority is containment. The OnboardAI system is still actively rejecting applicants from the affected regions right now. From the AI dashboard, Alice halts the OnboardAI system and routes all applications from the three affected regions to manual processing. No more automated decisions until the system is investigated and cleared. The correct order of response is: contain first , then investigate and report. Never wait for root cause analysis before stopping ongoing harm.

7. Connexion au portail des incidents

   Une fois le système confiné, Alice ouvre le portail interne de rapport d'incidents. L'accès est limité au personnel opérationnel autorisé : elle se connecte avec ses informations d'identification d'entreprise avant de déposer le rapport.

8. Dépôt du rapport d'incident

   Alice remplit le rapport d'incident avec les faits confirmés par l'équipe d'assistance et les mesures de confinement que l'équipe des opérations a déjà prises. Ce rapport sera acheminé à l'équipe de conformité, qui le transmettra à l'autorité de surveillance du marché.

9. Pourquoi chaque section est importante

   Le rapport fait désormais partie du dossier officiel. Chaque section répond à un objectif spécifique pour l’équipe de conformité et l’autorité de surveillance du marché.

10. Délais de déclaration

    The report has been submitted internally. Now, the legal timeline begins. Under Article 73, providers of high-risk AI systems must report serious incidents to the market surveillance authority: Immediately after the provider has established a causal link, or the reasonable likelihood of one, between the AI system and the incident No later than 15 days after the provider or, where applicable, the deployer becomes aware of the serious incident Sooner in the gravest cases: no later than 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure, and no later than 10 days if a person has died Deployers must inform the provider immediately, and then the market surveillance authority (Article 26(5)). Both providers and deployers must cooperate fully with any subsequent investigation by the authorities. SynapseAI deploys OnboardAI but did not build it - the provider is OnboardAI's vendor. SynapseAI must notify them immediately so they can fulfill their own reporting obligations.