Skip to main content
An incident is a problem someone is handling: a spike in guardrail violations, replies that leaked personal data, a provider that kept failing. It has an owner, a severity and a status, and everything done about it is kept on its timeline, so your organization can show what happened and what it did. Incidents, under Monitor in the sidebar, lists them, newest first. Filter by Open, Mine (open and assigned to you), Serious and Resolved, each with how many it holds, and by AI system. The list shows the newest 200.

​
Open an incident

Open one where the problem shows, and Altrum fills in what it can: Each incident has a title, an AI system (or none), a severity (Low, Medium or High), an owner, and what happened, which is optional. Add to incident on a request offers the open incidents you can change, those of the request’s own AI system first, or a new incident. A request is linked once; adding it again changes nothing.

​
Who can do what

Someone at Altrum acting for your organization does not see incidents.

​
Statuses

An incident is Open, Investigating, Mitigated or Resolved, and moves between them in any order.
  • Resolve asks what was done, and that shows at the top of the incident.
  • Reopen asks why it is open again.
  • A resolved incident cannot be changed and takes no notes until it is reopened.

​
The timeline

Every change is a dated entry, newest first, saying who made it: opening it and where from, notes, status, severity and owner changes, linked requests and reports, marking it serious and reported, resolving and reopening. Nothing on the timeline can be edited or deleted. A linked request opens its details, as in the request log. A linked report opens Guardrail violations for the incident’s AI system over the days it covered.

​
Serious incidents

Under the EU AI Act, the provider of a high risk AI system reports a serious incident to the market surveillance authority. A serious incident is one that leads to a death or serious harm to someone’s health, serious disruption of critical infrastructure, a breach of obligations that protect fundamental rights, or serious damage to property or the environment. Switch on Serious incident to mark one. The incident then shows Report by, 15 days after it was marked, the longest the Act allows. The tip beside it gives the shorter limits: 2 days when it is widespread or hits critical infrastructure, 10 days when someone died. When the report is made, select Mark reported: the incident records the date. Altrum does not send the report; it records that yours was sent. Switching Serious incident off clears the date it was reported.

​
Telling the owner

When an incident is assigned to someone, they get Incident assigned in the bell and by email, naming the incident, its severity and its AI system. The notice clears when the incident is resolved or assigned to someone else. Assigning an incident to yourself sends nothing. Each person can turn the email off in Email settings, under the account menu. See Alerts.

​
On the AI system

An AI system’s Overview shows its open incidents in an Incidents card, high severity first, up to three, with View all. The card is not there when none is open. Incidents do not change the AI system’s posture.

​
Recorded in the audit trail

Opening an incident, changing it, adding a note and linking a request each add an entry to the audit trail.