> ## Documentation Index
> Fetch the complete documentation index at: https://dev-docs.altrum.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Incidents

> Track a problem with an owner, a severity, a status and a timeline, open it from an alert, a report or a request, and record a serious incident under the EU AI Act.

An incident is a problem someone is handling: a spike in guardrail violations, replies that leaked personal data, a provider that kept failing. It has an owner, a severity and a status, and everything done about it is kept on its timeline, so your organization can show what happened and what it did.

**Incidents**, under **Monitor** in the sidebar, lists them, newest first. Filter by **Open**, **Mine** (open and assigned to you), **Serious** and **Resolved**, each with how many it holds, and by AI system. The list shows the newest 200.

## Open an incident

Open one where the problem shows, and Altrum fills in what it can:

| From | What is filled in | Who sees the action |
| - | - | - |
| **Incidents**, **New incident** | Nothing | Owners and admins, and anyone who owns an AI system |
| An alert in **Alerts**, **Create incident** | The title, the AI system, the alert, and High severity for a High alert, Medium for the rest | Owners and admins |
| A row of **Reporting**, **Guardrail violations**, **AI systems**, **Create incident** | The AI system, and a link to the report for that AI system over the range on screen | Owners and admins |
| A request in the [request log](/ai-gateway/request-logs), **Details**, **Add to incident** | The AI system and the request | Owners and admins |

Each incident has a title, an AI system (or none), a severity (**Low**, **Medium** or **High**), an owner, and what happened, which is optional.

**Add to incident** on a request offers the open incidents you can change, those of the request's own AI system first, or a new incident. A request is linked once; adding it again changes nothing.

## Who can do what

| | Owners and admins | The AI system's owner | The incident's owner | Everyone else |
| - | - | - | - | - |
| See incidents and their timelines | Yes | Yes | Yes | Yes |
| Open an incident | About anything | About their AI system | No | No |
| Change it, add notes, link requests | Yes | Yes | Yes | No |

Someone at Altrum acting for your organization does not see incidents.

## Statuses

An incident is **Open**, **Investigating**, **Mitigated** or **Resolved**, and moves between them in any order.

* **Resolve** asks what was done, and that shows at the top of the incident.
* **Reopen** asks why it is open again.
* A resolved incident cannot be changed and takes no notes until it is reopened.

## The timeline

Every change is a dated entry, newest first, saying who made it: opening it and where from, notes, status, severity and owner changes, linked requests and reports, marking it serious and reported, resolving and reopening. Nothing on the timeline can be edited or deleted.

A linked request opens its details, as in the request log. A linked report opens **Guardrail violations** for the incident's AI system over the days it covered.

## Serious incidents

Under the EU AI Act, the provider of a high risk AI system reports a serious incident to the market surveillance authority. A serious incident is one that leads to a death or serious harm to someone's health, serious disruption of critical infrastructure, a breach of obligations that protect fundamental rights, or serious damage to property or the environment.

Switch on **Serious incident** to mark one. The incident then shows **Report by**, 15 days after it was marked, the longest the Act allows. The tip beside it gives the shorter limits: 2 days when it is widespread or hits critical infrastructure, 10 days when someone died.

When the report is made, select **Mark reported**: the incident records the date. Altrum does not send the report; it records that yours was sent. Switching **Serious incident** off clears the date it was reported.

## Telling the owner

When an incident is assigned to someone, they get **Incident assigned** in the bell and by email, naming the incident, its severity and its AI system. The notice clears when the incident is resolved or assigned to someone else. Assigning an incident to yourself sends nothing.

Each person can turn the email off in **Email settings**, under the account menu. See [Alerts](/alerts#choose-which-alerts-you-get-by-email).

## On the AI system

An AI system's **Overview** shows its open incidents in an **Incidents** card, high severity first, up to three, with **View all**. The card is not there when none is open. Incidents do not change the AI system's [posture](/ai-systems/posture).

## Recorded in the audit trail

Opening an incident, changing it, adding a note and linking a request each add an entry to the [audit trail](/audit-trail).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.