AI Error and Incident Documentation

n8n, Make.com and Zapier automation with AI steps and a human approval check — fixed price, documented on handover.

What Is AI Error and Incident Documentation?

AI error and incident documentation is the written record of what an AI system got wrong, who or what it affected, when it was detected, when your team became aware, what caused it and what was corrected, kept in a form a regulator, an auditor or a customer can read without a walkthrough. As part of our AI assurance services, our remote assurance team sets up the incident register, error log, severity matrix and reporting runbook for companies in any country, then writes each incident up within 48 hours of the alert.

Work runs on a UTC+6 schedule: overnight turnaround for the Americas, same-day for Europe, the Middle East and Asia-Pacific, so a 48-hour draft never eats into a 15-day clock.
Fixed prices: a $590 readiness audit, then a $1,890 documentation setup · See pricing →
Book a Readiness Audit Send one AI error
5 days Readiness Audit $590 fixed price
2–3 weeks Documentation Setup $1,890 fixed price
48 hours Incident write-up $290 per incident
Monthly Managed Incident Desk $990 per month

What is included in an AI incident documentation setup?

Every AI incident documentation setup includes six deliverables. You get an AI system inventory with agreed incident definitions, an incident register and error log inside a tool you already use, a severity matrix tied to the reporting clocks that apply to you, report templates, an escalation runbook with training, and 30 days of incident write-ups after go-live. You receive a working record, not a policy PDF.

 

AI system inventory and incident definitions

Every AI system in scope, its owner, model version and the decisions it touches, with a written line between an error, an incident and a serious incident in your words and the law’s.

 

Incident register and error log

One register in your own Jira, ServiceNow, Airtable or Google Sheets, with fields for detection date, awareness date, affected people, severity, evidence links, owner and status, so each record works as an AI audit trail.

 

Severity matrix and reporting clocks

Four severity levels mapped to who must be told and by when: the EU AI Act’s 2-, 10- and 15-day Article 73 windows, 72 hours under the GDPR, and the breach-notification deadline of every other country you operate in.

 

Report templates

Three templates from one set of facts: an internal post-incident review, a customer or employee notice, and a regulator-format report that follows the structure of the European Commission’s draft Article 73 reporting template.

 

Escalation runbook and training

Who notices, who decides “is this an incident”, who signs and who files, with the clock start rules written down; a 60-minute recorded training for the people named in it.

 

30 days of incident write-ups

Included with every setup: for 30 days after go-live we write up every incident your register captures, up to three, at no extra cost, so the templates are tested on real events.

Not included: legal advice on whether to notify (we prepare the file; your counsel decides) · filing with regulators on your behalf · fixing the AI system itself, which is covered by AI model testing.

How does an AI incident move from a wrong output to a closed record?

An AI incident moves through six steps: the wrong output, detection, awareness (when legal reporting clocks start), a severity check, notification if required, and a write-up with root cause and corrective action. Each step has a named owner and is timestamped in the incident register, so every reporting deadline can be proven.

AI incident lifecycle

From one wrong output to a closed incident record

The legal clock starts at awareness, not at the error. Every step leaves a dated entry in the register.

  1. 01Wrong outputThe AI system classifies, extracts or decides incorrectly.
  2. 02DetectedAlert, approval step, audit sample or customer complaint.
  3. 03 · clock startsAwareYour organisation knows. Reporting deadlines count from here.
  4. 04Severity checkError, incident or serious incident, against the legal definitions.
  5. 05Notify if requiredEU AI Act 2, 10 or 15 days · GDPR 72 hours · local breach laws.
  6. 06Write-up & closeRoot cause, corrective action and evidence filed in the register.

Eicra draft within 48 hours of your alertso counsel decides whether to notify on day two, not day fourteen.

What counts as an AI incident, and which frameworks apply?

An AI incident is a wrong output that reached a person or a system of record; an error is one caught before it acted, and a serious incident is one that meets the EU AI Act Article 3(49) harm test. Each record is mapped to the EU AI Act, ISO/IEC 42001, the NIST AI RMF and the data-protection breach rules that apply to you.

What counts as an AI error or incident?

Error A wrong output caught before it acted on anything: a hallucinated invoice total rejected at the approval step. Logged for trend analysis, not reported.
Incident A wrong output that reached a person or a system of record: a candidate wrongly filtered out, an incorrect payslip issued, a support reply that promised a refund you do not offer.
Serious incident Article 3(49) of the EU AI Act: death or serious harm to health, serious and irreversible disruption of critical infrastructure, a breach of fundamental-rights obligations, or serious harm to property or the environment.
Near miss An error stopped by a human-in-the-loop review step or a confidence threshold. Counted, because a rising near-miss rate is the earliest warning you will get.

Which frameworks does the documentation follow?

EU AI Act Article 73 serious-incident reporting and the Commission’s draft reporting template; Article 12 and 19 log-keeping; the Article 26 duty on deployers to inform the provider. The wider technical file is covered by our EU AI Act technical documentation service.
ISO 42001 ISO/IEC 42001 Annex A control A.8.4 (communication of incidents), A.6.2.8 (event logs) and A.6.2.6 (operation and monitoring), laid out so an auditor finds each record without a mapping exercise; the policy layer sits in AI risk and governance documentation.
NIST AI RMF GOVERN 4.3 and MANAGE 4: incidents and errors communicated, response and recovery documented, with owners named.
Data protection GDPR Article 33 (72 hours to the supervisory authority) and the equivalent breach-notification law in each jurisdiction where you operate, whenever an AI incident also involves personal data.

How does AI incident documentation work, step by step?

Our AI incident documentation runs in four fixed-price steps: a five-day readiness audit ($590), a two-to-three-week documentation setup ($1,890), 48-hour incident write-ups ($290 each) and an optional Managed Incident Desk ($990 a month). The record matters more each year: Stanford’s 2026 AI Index counts 362 documented AI incidents in 2025, up from 233 in 2024.

01 5 days · $590
Readiness Audit Inventory of every AI system in scope, a gap review of the logs and tickets you keep today, the reporting clocks that apply to each system, a two-page verdict and a fixed setup quote.
02 2–3 weeks · $1,890
Documentation Setup Register, error log, severity matrix, three report templates, escalation runbook and training, tested on three past incidents or tabletop drills before sign-off.
03 48 hours · $290
Incident write-up From your alert to a signed draft: timeline, evidence, affected records, root cause, corrective action and, where the severity calls for it, a regulator-format report ready for counsel.
04 Monthly · $990
Managed Incident Desk Up to three write-ups a month, a monthly error-log review, a quarterly trend report for your board or audit committee, and register upkeep as systems change.

How much does it cost?

Setting up AI incident documentation with us costs $1,890 in fixed fees and is live in three to four weeks: the $590 readiness audit is credited in full when you go ahead with the $1,890 setup. After that you pay $290 per incident write-up, or $990 a month for the Managed Incident Desk. For testing outputs before they reach anyone, see AI model testing; for the wider assurance line, see our AI assurance services.

Team AI assurance analysts, working remotely
Tools Your Jira, ServiceNow, Airtable or Sheets
Communication Shared channel, 48-hour draft SLA, monthly report
What you receive

An AI incident register your auditor can read without a walkthrough

Built inside your own Jira, ServiceNow, Airtable or Google Sheets, with the awareness date and reporting deadline on every row.

AI incident register · 4 open · 2 closed this quarterIllustrative sample · fictional data
ID System · model Aware Severity Category Affected Notify Deadline Status
INC-014 Invoice reader · v3.2 12 Sep Error Accuracy 0 records No — Closed
INC-015 Support reply bot · v1.8 15 Sep Incident Accuracy 37 customers Customers 22 Sep Write-up sent
INC-016 CV screening · v2.0 19 Sep Serious Bias 112 applicants Regulator 4 Oct Counsel review
INC-017 Payroll checker · v1.1 24 Sep Incident Privacy 9 employees Regulator · 72h 27 Sep Draft in 48h

Severity is shown as a label as well as a colour. Fields map to ISO/IEC 42001 A.8.4 and the EU AI Act Article 73 draft reporting template.

Why choose us for AI incident documentation?

Most companies now run AI in production but few keep a record they would show a regulator. The AI Index’s 2026 survey with McKinsey found the share of organisations rating their own AI incident response “excellent” fell from 28% to 18% in a year. We fix the record, not the rating: fixed prices, a 48-hour draft on every incident, templates mapped to the law and the standards, and everything stored in accounts you own.

Published fixed prices — every step is priced before you start, from the $590 readiness audit to the Managed Incident Desk at $990 a month.
48-hour drafts — every incident write-up is drafted within 48 hours of your alert, so the decision to notify is made on day two, not day fourteen.
Tested before sign-off — the setup is run against three past incidents or drills, and you sign off only when the register and templates capture them cleanly.
Mapped, not invented — fields and templates follow EU AI Act Article 73, ISO/IEC 42001 A.8.4 and NIST AI RMF GOVERN 4.3, so no auditor has to translate our format into theirs.
You own everything — the register lives in your tool, the templates are editable files, and our access is removed when the engagement ends.
Named contracts — GDPR Article 28(3) processor terms plus the cross-border transfer clauses your country requires (standard contractual clauses or the equivalent transfer mechanism), signed before we see a single log.
Reporting deadlines

Days from awareness to the regulator’s deadline

Shortest clock first. The 48-hour draft matches the tightest deadline and lands well inside the rest.

Maximum time from awareness to the regulator’s deadline, shortest first
Law and trigger Deadline
EU AI Act: widespread infringement or critical-infrastructure disruption 2 days
GDPR: personal-data breach, notify the supervisory authority 72 hours
EU AI Act: serious incident involving the death of a person 10 days
EU AI Act: any other serious incident 15 days

Eicra draft: 48 hours = 2 daysready before counsel has to decide on the tightest clock.

Sources: EU AI Act Art. 73(2)–(4); GDPR Art. 33. EU high-risk obligations deferred to 2 December 2027 by Regulation (EU) 2026/1744.

Worked example · fictional incident

What does a 48-hour AI incident write-up look like?

An abridged write-up for a made-up payroll incident, in the order our template uses. Names and numbers are invented; the structure is the deliverable.

Incident: INC-017 · Payroll checker v1.1 (LLM-based anomaly review) · Category: privacy · Severity: incident.

Timeline: 23 Sep 21:40 UTC wrong output · 24 Sep 06:10 detected at the approval step · 24 Sep 09:00 organisation aware (clock starts) · 24 Sep 09:30 contained · 26 Sep 07:55 draft delivered, 47 hours after alert.

What happened: The model’s review summary quoted salary lines from one employee’s payslip into a query about another, so 9 payslip summaries reached the wrong line managers.

Root cause: A retrieval step matched records on first name only after a data-mapping change on 22 Sep; no test covered duplicate first names.

Corrective action: Matching moved to employee ID; 40 duplicate-name test cases added; approval step now blocks summaries that reference more than one employee.

Notification decision: Personal-data breach under the applicable data-protection law; draft regulator report prepared for counsel within the 72-hour window; 9 employees notified. EU AI Act Article 73 not triggered: not a high-risk system. Ongoing checks on systems like this are covered by AI oversight for payroll.

Case studies: This service line launched in 2026; anonymised incident write-ups and client case studies will be added here as engagements complete, with each client’s permission.
Free 30-minute incident review Send us one AI error your team dealt with last quarter. You get a written note on how it should have been recorded, which clocks it would have started and what it would cost to document properly, whether or not you hire us.

Send one AI error

How common are AI incidents, and how fast must you report them?

AI incidents are rising fast: the AI Incident Database recorded 362 in 2025, up from 233 in 2024. Once your organisation is aware of a serious incident, the EU AI Act allows at most 15 days to report it, and only 18% of organisations rated their own AI incident response excellent in 2025.

362 Documented AI incidents recorded in 2025, up from 233 in 2024 and fewer than 100 a year before 2022. Source: Stanford HAI, 2026 AI Index Report, Responsible AI chapter
15 days Maximum time under EU AI Act Article 73 to report a serious incident after becoming aware of it; 10 days where a person has died, 2 days for a widespread infringement. Source: European Commission AI Act Service Desk, Article 73
18% Organisations that rated their AI incident response “excellent” in 2025, down from 28% in 2024, while the share reporting three to five incidents rose from 30% to 50%. Source: AI News on the 2026 AI Index, 16 April 2026

Is it safe to outsource AI incident documentation?

Outsourcing AI incident documentation is safe when the file is built inside your systems and the safeguards are signed first. Incident files are sensitive by nature: they contain the evidence of what went wrong, so every engagement opens with a mutual NDA, a data processing agreement and least-privilege access, we work from redacted exports wherever possible, and we keep no copies after handover.

  1. 1 · Before accessNDA and DPA signed
  2. 2 · Data minimisedRedacted exports from your systems
  3. 3 · During workNamed, least-privilege accounts
  4. 4 · Where files liveRegister and write-ups stay in your tool
  5. 5 · At handoverOur access removed, no copies kept
How your incident data moves during an engagement: signed first, minimised, kept in your systems, and access removed at the end.
Contracts and transfers

Which agreements are signed, and when?

NDA — mutual, signed before we see any log, ticket or output.
DPA — the processor terms required by Article 28(3) of the GDPR or your local equivalent, for any incident file that contains personal information.
Cross-border transfers — the standard contractual clauses or transfer mechanism your data-protection law requires, signed before any personal data moves.
All clients — contract terms matched to your local data law; SOC 2 readiness roadmap available on request; certifications are listed only when held.
Controls, privilege and service levels

What access, privilege and rework terms apply?

Access Read access to logs and tickets in scope, edit access to the register in your tool, named accounts only, removed at handover or when the desk ends.
Privilege Where your counsel directs the review, we work under their instruction so the file can be structured the way they need; ask your lawyer before the first incident, not after.
Ownership Register, templates, runbook and every write-up are yours from day one; we retain no copies after the engagement.
Rework Free when a write-up misses the agreed template or the 48-hour draft window; changes of scope are priced first as a change request.
Request our NDA, DPA and data-transfer templates →

AI incident documentation FAQs: cost, deadlines and templates

How much does this cost? See pricing →

Last updated 3 October 2026 · Reviewed by Asma Sultana Minu, Local Corporate Counsel, Eicra Soft Limited · Not legal advice

What is AI incident documentation?

AI incident documentation is the written record of what an AI system got wrong, who or what it affected, when it was detected, when your team became aware, what caused it and what was corrected. It lives in an incident register, is written to a fixed template, and is kept so that a regulator, auditor, insurer or customer can read it without a walkthrough.

How much does AI incident documentation cost?

With Eicra Soft, setting up AI incident documentation costs a fixed $1,890: a $590 five-day readiness audit, credited in full against the $1,890 documentation setup, live in three to four weeks. After that, each incident write-up is $290 with a 48-hour draft, or the Managed Incident Desk covers up to three write-ups a month plus a monthly error-log review for $990 a month.

What are the EU AI Act Article 73 reporting deadlines?

Article 73 of the EU AI Act requires providers of high-risk AI systems to report a serious incident to the national market surveillance authority no later than 15 days after becoming aware of it, within 10 days if a person has died, and within 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure. An incomplete initial report may be filed first, followed by a complete one. The wider high-risk regime was deferred to 2 December 2027 by Regulation (EU) 2026/1744; commentators disagree on whether Article 73 moved with it, so we build the record now.

Does the EU AI Act apply to a company outside the EU?

Yes, if it places an AI system on the EU market or its system’s output is used in the EU. The EU AI Act applies to those providers and deployers wherever the company is based. Companies with no EU users usually face their own national rules instead, such as personal-data breach notification deadlines and newer laws on automated decision-making. Our readiness audit maps which clocks apply to each of your systems in every country where you operate.

What should an AI incident report include?

An AI incident report should include the system and model version involved, a timeline from first wrong output to detection to awareness to containment, the people or records affected and how many, the evidence (logs, prompts, outputs, approvals), the root cause, the corrective and preventive action, who decided what and when, and whether any external notification was required. Our template follows this order so the same file serves an internal review, a customer notice and a regulator report.

How is an AI error different from an AI incident?

An AI error is caught before it acts on anything; an AI incident is a wrong output that reached a person or a system of record. For example, a hallucinated invoice total rejected at the approval step is an error: it is logged for trend analysis but not reported. A candidate wrongly filtered out or an incorrect payslip issued is an incident. A serious incident, under Article 3(49) of the EU AI Act, is one that directly or indirectly leads to death or serious harm to health, serious and irreversible disruption of critical infrastructure, a breach of fundamental-rights obligations, or serious harm to property or the environment.

We already have an IT incident process. Why do we need this?

IT incident tools such as PagerDuty, incident.io or Jira Service Management record outages: a service was down, and it came back. AI incidents are different: the system stayed up and produced a confident wrong answer, so there is no alert, no downtime and often no ticket. AI incident documentation adds the fields these tools do not capture by default: model version, prompt and output evidence, affected individuals, awareness date and the regulatory clock. We build it inside the tool you already use rather than replacing it.

What fields should an AI incident log have?

A usable AI incident log has at least: incident ID, system and model version, date of first wrong output, date detected, date your organisation became aware, severity level, category (accuracy, bias, privacy, safety, security), affected people or records and count, evidence links, containment action, root cause, corrective action, owner, external notification required (yes/no, to whom, deadline, date sent) and status. We set this up in Jira, ServiceNow, Airtable or Google Sheets, whichever your team already opens every day.

How does this relate to ISO/IEC 42001 and NIST AI RMF?

ISO/IEC 42001 (usually searched as ISO 42001) Annex A control A.8.4 requires an organisation to communicate AI incidents and keep the records that prove it did; A.6.2.8 requires event logs and A.6.2.6 requires operation and monitoring records. NIST AI RMF GOVERN 4.3 and MANAGE 4 expect incidents and errors to be communicated and response and recovery to be documented. Our register and templates are laid out against these controls, so an auditor can find each piece of evidence without a mapping exercise.

Do you write an AI incident response plan?

Yes. The escalation runbook in every documentation setup is an AI incident response plan: it names who notices an AI failure, who decides whether it is an incident, who contains it, who signs the write-up and who notifies which regulator by when. Unlike an IT incident response plan built for outages, it covers wrong outputs from systems that stayed online, and it is tested on three past incidents or drills before sign-off.

Who decides whether an incident must be reported to a regulator?

Your organisation does, normally your legal counsel or data protection officer. We prepare the file: the facts, the timeline, the severity assessment against the legal definitions and a draft report in the required format, delivered within 48 hours so the decision is made on day two, not day fourteen. We do not give legal advice and we do not file with authorities on your behalf.

What access do you need to our systems?

Read access to the logs, tickets and approval records for the AI systems in scope, plus edit access to the register we build in your own tool. Wherever possible we work from exports with personal data redacted. Work starts after a mutual NDA, personal data is handled under a data processing agreement, our access is least-privilege and named, and it is removed at handover or when the Managed Incident Desk ends.

Who owns the register and reports if we stop working together?

Your company does, from day one. The register lives in your own Jira, ServiceNow, Airtable or Sheets account, the templates and runbook are delivered as editable files, and every write-up is stored in your systems, not ours. When the engagement ends you keep everything and our access is removed.

Start with a five-day AI incident readiness audit, $590 fixed. You leave with an inventory of your AI systems, the reporting clocks that apply to each one and a fixed setup price, whether or not you hire us.
Book a Readiness Audit Send one AI error