Published

AI Incident Report

vr.wm-ai-010 · wm-ai-010-ai-incident-report

Represent one governed, versioned AI incident reporting case that makes facts, timeline, affected systems, classification, impact, causal assessments, response, obligations, submissions and corrections machine-readable without absorbing the incident or authority masters.

World Models Information and virtual systems INF.AI.INC

Bundle → Layer → Finding → Questions Classifiers What it is Why it exists Distinguishing features What robots and AI may and may not do Moral aspects Owners Links to other meta-models Identity and identifiers Direct properties Recognition Capabilities and actions Hazards and failure modes Standards and interfaces Context of use Sources

Bundle → Layer → Finding → Questions Filled

6 bundles · 12 layers · 24 findings · 72 questions

Report identity, scope, jurisdiction and parties Groups governed report context for report identity, scope, jurisdiction and parties.

Report root, version, status and authority

Groups source-qualified report context for report root, version, status and authority.

Report case identity, type, version, issuer and current head

Records report case identity, type, version, issuer and current head as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish report case identity, type, version, issuer and current head? identity
Who observed, asserted, reviewed, approved, received or may rely on report case identity, type, version, issuer and current head, under which authority and limits? event
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify report case identity, type, version, issuer and current head? process

Jurisdiction, legal basis, recipient, reportability and authority

Records jurisdiction, legal basis, recipient, reportability and authority as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish jurisdiction, legal basis, recipient, reportability and authority? authority
Who observed, asserted, reviewed, approved, received or may rely on jurisdiction, legal basis, recipient, reportability and authority, under which authority and limits? temporal
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify jurisdiction, legal basis, recipient, reportability and authority? validation

Incident, system and party bindings

Groups source-qualified report context for incident, system and party bindings.

Incident, related report, affected system, deployment, model and version

Records incident, related report, affected system, deployment, model and version as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish incident, related report, affected system, deployment, model and version? relationship
Who observed, asserted, reviewed, approved, received or may rely on incident, related report, affected system, deployment, model and version, under which authority and limits? composition
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify incident, related report, affected system, deployment, model and version? privacy

Reporter, provider, deployer, operator, contact and responsibility

Records reporter, provider, deployer, operator, contact and responsibility as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish reporter, provider, deployer, operator, contact and responsibility? ownership
Who observed, asserted, reviewed, approved, received or may rely on reporter, provider, deployer, operator, contact and responsibility, under which authority and limits? evidence
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify reporter, provider, deployer, operator, contact and responsibility? lifecycle

Occurrence, observation, context and timeline Groups governed report context for occurrence, observation, context and timeline.

Event clock, location and evidence source

Groups source-qualified report context for event clock, location and evidence source.

Occurrence, detection, discovery, awareness, notification and report time

Records occurrence, detection, discovery, awareness, notification and report time as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish occurrence, detection, discovery, awareness, notification and report time? temporal
Who observed, asserted, reviewed, approved, received or may rely on occurrence, detection, discovery, awareness, notification and report time, under which authority and limits? ownership
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify occurrence, detection, discovery, awareness, notification and report time? quality

Location, channel, source, observer, confidence, gap and unavailability

Records location, channel, source, observer, confidence, gap and unavailability as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish location, channel, source, observer, confidence, gap and unavailability? evidence
Who observed, asserted, reviewed, approved, received or may rely on location, channel, source, observer, confidence, gap and unavailability, under which authority and limits? measurement
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify location, channel, source, observer, confidence, gap and unavailability? security

Behavior, sequence and operating context

Groups source-qualified report context for behavior, sequence and operating context.

Behavior, failure, malfunction, output, action, outcome and sequence

Records behavior, failure, malfunction, output, action, outcome and sequence as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish behavior, failure, malfunction, output, action, outcome and sequence? event
Who observed, asserted, reviewed, approved, received or may rely on behavior, failure, malfunction, output, action, outcome and sequence, under which authority and limits? exception
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify behavior, failure, malfunction, output, action, outcome and sequence? retention

Lifecycle stage, environment, data, input, output, human and tool context

Records lifecycle stage, environment, data, input, output, human and tool context as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish lifecycle stage, environment, data, input, output, human and tool context? composition
Who observed, asserted, reviewed, approved, received or may rely on lifecycle stage, environment, data, input, output, human and tool context, under which authority and limits? provenance
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify lifecycle stage, environment, data, input, output, human and tool context? interoperability

Classification, severity, impact and harm Groups governed report context for classification, severity, impact and harm.

Incident class, severity and causal threshold

Groups source-qualified report context for incident class, severity and causal threshold.

Incident, hazard, near miss, serious criterion, category and severity

Records incident, hazard, near miss, serious criterion, category and severity as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish incident, hazard, near miss, serious criterion, category and severity? classification
Who observed, asserted, reviewed, approved, received or may rely on incident, hazard, near miss, serious criterion, category and severity, under which authority and limits? process
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify incident, hazard, near miss, serious criterion, category and severity? decision

Causal link, likelihood, attribution, scope, confidence and uncertainty

Records causal link, likelihood, attribution, scope, confidence and uncertainty as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish causal link, likelihood, attribution, scope, confidence and uncertainty? decision
Who observed, asserted, reviewed, approved, received or may rely on causal link, likelihood, attribution, scope, confidence and uncertainty, under which authority and limits? validation
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify causal link, likelihood, attribution, scope, confidence and uncertainty? state

Affected subjects, rights, assets and consequences

Groups source-qualified report context for affected subjects, rights, assets and consequences.

Person, group, right, health, safety, property, infrastructure and environment

Records person, group, right, health, safety, property, infrastructure and environment as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish person, group, right, health, safety, property, infrastructure and environment? measurement
Who observed, asserted, reviewed, approved, received or may rely on person, group, right, health, safety, property, infrastructure and environment, under which authority and limits? privacy
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify person, group, right, health, safety, property, infrastructure and environment? identity

Geography, system, service, scale, duration, persistence and reversibility

Records geography, system, service, scale, duration, persistence and reversibility as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish geography, system, service, scale, duration, persistence and reversibility? measurement
Who observed, asserted, reviewed, approved, received or may rely on geography, system, service, scale, duration, persistence and reversibility, under which authority and limits? lifecycle
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify geography, system, service, scale, duration, persistence and reversibility? classification

Cause, security, privacy, investigation and evidence Groups governed report context for cause, security, privacy, investigation and evidence.

Cause, contributor, investigation and assessment

Groups source-qualified report context for cause, contributor, investigation and assessment.

Model, data, software, hardware, supplier, human, process and organization factor

Records model, data, software, hardware, supplier, human, process and organization factor as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish model, data, software, hardware, supplier, human, process and organization factor? provenance
Who observed, asserted, reviewed, approved, received or may rely on model, data, software, hardware, supplier, human, process and organization factor, under which authority and limits? quality
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify model, data, software, hardware, supplier, human, process and organization factor? relationship

Root or contributing factor, hypothesis, investigation method, finding and review

Records root or contributing factor, hypothesis, investigation method, finding and review as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish root or contributing factor, hypothesis, investigation method, finding and review? validation
Who observed, asserted, reviewed, approved, received or may rely on root or contributing factor, hypothesis, investigation method, finding and review, under which authority and limits? security
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify root or contributing factor, hypothesis, investigation method, finding and review? authority

Security, adversarial and personal-data breach

Groups source-qualified report context for security, adversarial and personal-data breach.

Threat actor, vulnerability, attack technique, poisoning, evasion, privacy and misuse

Records threat actor, vulnerability, attack technique, poisoning, evasion, privacy and misuse as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish threat actor, vulnerability, attack technique, poisoning, evasion, privacy and misuse? security
Who observed, asserted, reviewed, approved, received or may rely on threat actor, vulnerability, attack technique, poisoning, evasion, privacy and misuse, under which authority and limits? retention
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify threat actor, vulnerability, attack technique, poisoning, evasion, privacy and misuse? requirement

Personal-data breach, confidentiality, integrity, availability, risk and notification

Records personal-data breach, confidentiality, integrity, availability, risk and notification as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish personal-data breach, confidentiality, integrity, availability, risk and notification? privacy
Who observed, asserted, reviewed, approved, received or may rely on personal-data breach, confidentiality, integrity, availability, risk and notification, under which authority and limits? interoperability
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify personal-data breach, confidentiality, integrity, availability, risk and notification? constraint

Response, remediation, notification and authority exchange Groups governed report context for response, remediation, notification and authority exchange.

Containment, recovery, corrective and preventive action

Groups source-qualified report context for containment, recovery, corrective and preventive action.

Immediate containment, safeguard, continuity, recovery and residual risk

Records immediate containment, safeguard, continuity, recovery and residual risk as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish immediate containment, safeguard, continuity, recovery and residual risk? process
Who observed, asserted, reviewed, approved, received or may rely on immediate containment, safeguard, continuity, recovery and residual risk, under which authority and limits? decision
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify immediate containment, safeguard, continuity, recovery and residual risk? event

Corrective or preventive action, owner, due date, verification and effectiveness

Records corrective or preventive action, owner, due date, verification and effectiveness as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish corrective or preventive action, owner, due date, verification and effectiveness? lifecycle
Who observed, asserted, reviewed, approved, received or may rely on corrective or preventive action, owner, due date, verification and effectiveness, under which authority and limits? state
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify corrective or preventive action, owner, due date, verification and effectiveness? temporal

Obligation, deadline, submission and authority response

Groups source-qualified report context for obligation, deadline, submission and authority response.

Recipient, regime, trigger, awareness clock, deadline, exception and extension

Records recipient, regime, trigger, awareness clock, deadline, exception and extension as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish recipient, regime, trigger, awareness clock, deadline, exception and extension? requirement
Who observed, asserted, reviewed, approved, received or may rely on recipient, regime, trigger, awareness clock, deadline, exception and extension, under which authority and limits? identity
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify recipient, regime, trigger, awareness clock, deadline, exception and extension? composition

Initial, intermediate or final submission, receipt, question, response and status

Records initial, intermediate or final submission, receipt, question, response and status as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish initial, intermediate or final submission, receipt, question, response and status? relationship
Who observed, asserted, reviewed, approved, received or may rely on initial, intermediate or final submission, receipt, question, response and status, under which authority and limits? classification
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify initial, intermediate or final submission, receipt, question, response and status? evidence

Governance, disclosure, lifecycle, records and projections Groups governed report context for governance, disclosure, lifecycle, records and projections.

Approval, confidentiality, communication and public summary

Groups source-qualified report context for approval, confidentiality, communication and public summary.

Author, approver, legal review, attestation, conflict and accountability

Records author, approver, legal review, attestation, conflict and accountability as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish author, approver, legal review, attestation, conflict and accountability? authority
Who observed, asserted, reviewed, approved, received or may rely on author, approver, legal review, attestation, conflict and accountability, under which authority and limits? relationship
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify author, approver, legal review, attestation, conflict and accountability? ownership

Confidentiality, privilege, trade secret, minimization, public summary and notice

Records confidentiality, privilege, trade secret, minimization, public summary and notice as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish confidentiality, privilege, trade secret, minimization, public summary and notice? privacy
Who observed, asserted, reviewed, approved, received or may rely on confidentiality, privilege, trade secret, minimization, public summary and notice, under which authority and limits? authority
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify confidentiality, privilege, trade secret, minimization, public summary and notice? measurement

Evidence, correction, retention, audit and interoperability

Groups source-qualified report context for evidence, correction, retention, audit and interoperability.

Attachment, evidence, digest, chain of custody, source and provenance

Records attachment, evidence, digest, chain of custody, source and provenance as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish attachment, evidence, digest, chain of custody, source and provenance? evidence
Who observed, asserted, reviewed, approved, received or may rely on attachment, evidence, digest, chain of custody, source and provenance, under which authority and limits? requirement
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify attachment, evidence, digest, chain of custody, source and provenance? exception

Draft, submitted, accepted, amended, superseded, closed, reopened, retained and projected

Records draft, submitted, accepted, amended, superseded, closed, reopened, retained and projected as source-qualified report context while incident, system, investigation, authority, remediation, evidence and records masters remain external.

What stable identity, report version, jurisdiction-qualified value and explicit unknown establish draft, submitted, accepted, amended, superseded, closed, reopened, retained and projected? lifecycle
Who observed, asserted, reviewed, approved, received or may rely on draft, submitted, accepted, amended, superseded, closed, reopened, retained and projected, under which authority and limits? constraint
Which occurrence, awareness, effective, submitted, recorded, ingested and knowledge times, evidence and uncertainty qualify draft, submitted, accepted, amended, superseded, closed, reopened, retained and projected? provenance

Classifiers Filled

Family: World Models
Category: Information and virtual systems
Entry kind: aggregate
Navigation path: NAV.INF.AI.INC
Domain: INF.AI.INC
Industry: Cross-industry
Tags: aiincidentreportinf.ai.inc

What it is Filled

Owns report-case identity, version and status; issuer, jurisdiction, legal basis, recipient and reportability assertions; incident, affected-system and party bindings; facts, timeline, context, classification, severity, impact, harm, causal, security and privacy assessments; response and remediation summaries; notification duties, deadlines, submissions, receipts and authority exchanges; approval, confidentiality, communication, evidence, correction, retention, audit and projections. Incident, AI system, model, deployment, investigation, regulatory case, remediation work, harm, vulnerability, evidence, audit and records masters remain external.

In scope

Report identity, version, jurisdiction, legal basis, recipient, affected systems, responsible parties, facts, timeline, context, classification, severity, impact and causal assessments
Security and privacy links, response and remediation summaries, obligations, deadlines, submissions, receipts, authority exchanges, disclosure, lifecycle, evidence, retention, audit and projections

Out of scope

Owning the incident, affected AI system, model, deployment, person, organization, harm, investigation, regulatory case, remediation action, vulnerability, evidence, audit or records masters
Treating report receipt, mitigation deployment, system recovery or closure as proof of causality, acceptance, effectiveness, compliance or absence of harm
Autonomous legal classification, regulatory submission, public disclosure, liability admission, attribution, access expansion, evidence destruction or closure

Why it exists Filled

Distinguishing features Filled

A reporting case with versions and submissions about an incident, not the incident itself.
Keeps observed fact, reporter statement, hypothesis, causal assessment and authority finding apart.
Does not equate an AI incident with a security incident, data breach or defect, though it may link them.
Carries reportability, recipient and deadline assertions tied to a legal basis.

What robots and AI may and may not do Filled

Must not

Submit a report to an authority.
Make a binding legal classification or reportability decision.
Admit liability or assign blame to a person.
Disclose restricted details or personal data of affected people.
Alter facts in a submitted version instead of issuing a correction.

Only with a human decision

Deciding whether an incident is reportable and to whom.
Approving and submitting a report.
Public disclosure of incident details.

May

Collect source-qualified facts and build a timeline.
Calculate reporting deadlines from the declared legal basis.
Draft initial, intermediate and final report versions for review.
Link related security, privacy and investigation records.

Moral aspects Filled

Affected people deserve timely notice and remedy, so delays in reporting cause real harm.
Reports must protect the identity of affected people and of whistleblowers.
Blame on individual operators can hide systemic causes in design or deployment.

Who is affected

People harmed or affected by the AI system
Reporters and whistleblowers
Deployers, providers and authorities

Owners Filled

Steward

Dimension owner, incident-reporting mandate and accountable AI system owner

Roles

AI system owner and accountable deployer: Own reporting readiness, accountable assessment, response coordination and use of incident reports.
Incident reporter and case coordinator: Maintain report identity, source-qualified facts, timeline, versions, submissions and authority exchanges.
Technical investigator and AI specialist: Supply bounded system, model, data, failure, causal and corrective evidence with uncertainty.
Safety, security and privacy responder: Assess harm, threat, vulnerability, privacy-breach, containment, notification and residual risk profiles.
Legal, compliance and regulatory liaison: Determine applicable regimes, deadlines, recipients, privilege, confidentiality and approved submissions.
Independent reviewer and approval authority: Review evidence, conflicts, classifications, causal claims, completeness and release decisions within mandate.
Records and disclosure steward: Own access, minimization, public summaries, legal hold, retention, disposition and projection policy.

Links to other meta-models Filled

references

WM-AI-001 AI System - Represent the unfrozen parent and affected-system boundary without inheritance, composition, mutation, release or cascade authority.
WM-ACT-019 Incident - Resolve the underlying general incident while preserving a separate reporting-case identity and lifecycle.
Investigation, regulatory case, remediation, harm, vulnerability, evidence, audit and records models - Resolve authoritative findings, actions, decisions and evidence without absorbing their ownership.

aligned

EU AI Act, OECD AI incident framework, NIST AI RMF and SP 800-61r3, FIRST CSIRT, ISO/IEC 42001, PROV-O and RFC 3339 - Project version-pinned legal, reporting, risk, response, management, provenance and timestamp views with declared loss.

neighbor

WM-AI-001 AI System - The unified parent signal and candidate reference identify affected-system context but grant no inheritance or ownership. The report binds source-qualified system, model and deployment versions without mutating their masters.
WM-ACT-019 Incident - The general incident master owns occurrence, operational state and response history. The report owns a versioned communication and submission case about that incident.
Investigation, remediation and regulatory case - Investigations own methods and findings, remediation work owns actions and verification, and authorities own their cases and decisions. The report stores non-owning summaries, submissions, receipts and exchanges.
Security incident and personal-data breach - Cybersecurity and privacy regimes may overlap an AI incident but use independent applicability, risk, notification and authority semantics.
EU AI Act, OECD, NIST, FIRST, ISO, PROV and RFC profiles - These legal, reporting, risk, incident-response, management, provenance and timestamp sources have distinct scopes. No mapping is assumed binding or lossless outside its profile.

parent

WM-AI-001

What else AI and robots need to interact with it Filled

Sources Filled

Regulation (EU) 2024/1689 Artificial Intelligence Act, consolidated text - European Union
Draft guidance and reporting template on serious AI incidents - European Commission
Defining AI incidents and related terms - Organisation for Economic Co-operation and Development
Towards a common reporting framework for AI incidents - Organisation for Economic Co-operation and Development
AI Incidents and Hazards Monitor - Organisation for Economic Co-operation and Development
Artificial Intelligence Risk Management Framework (AI RMF 1.0) - National Institute of Standards and Technology
Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile - National Institute of Standards and Technology
Incident Response Recommendations and Considerations for Cybersecurity Risk Management - National Institute of Standards and Technology
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations - National Institute of Standards and Technology
Regulation (EU) 2016/679 General Data Protection Regulation - European Union
Guidelines 9/2022 on personal data breach notification under GDPR - European Data Protection Board
CSIRT Services Framework - Forum of Incident Response and Security Teams
ISO/IEC 42001 AI management systems - International Organization for Standardization
PROV-O: The PROV Ontology - World Wide Web Consortium
Date and Time on the Internet: Timestamps - Internet Engineering Task Force

Open questions

Approve or reject the WM-AI-001 and WM-ACT-019 relationships and register investigation, remediation, authority-case, harm, vulnerability, evidence and records edges.
Create jurisdiction, sector, AI-system-class, seriousness, causal-threshold, deadline, recipient and reporting-template profiles.
Refresh the EU Article 73 mapping when final guidance and templates replace the inspected draft package.
Validate organization-specific privilege, trade-secret, personal-data, security, disclosure, affected-person communication and retention policies.
Test version-pinned EU, OECD, NIST, FIRST, ISO, PROV and RFC mappings and obtain supplemental independent external review before canonical promotion.
Claude and Grok each timed out on one bounded attempt; no independent external result was admitted.
The unified parent WM-AI-001 and candidate references to WM-AI-001 and WM-ACT-019 are not approved frozen composition edges.
The European Commission Article 73 guidance and high-risk-system template inspected here remain draft.
Sector, jurisdiction, system-class and regulator-specific notification forms and deadlines require separate profiles.

Machine files

Card as JSON Specification AGENTS.md Source Card backlog vercy.card/1

Provenance

world-models research · reviewable-draft

Built from: models/wm-ai-010-ai-incident-report/spec.yaml, ver-cy/world-models/card-supplements/wm-ai-010-ai-incident-report.json