AI incidents need more than a generic security clause
An AI incident may involve inaccurate or discriminatory outputs, unsafe recommendations, failed human oversight, misleading synthetic content, unexpected data use, model drift or an upstream provider change. Many of these events do not fit neatly into a conventional personal-data-breach or cybersecurity clause.
The contract should therefore include an AI-specific evidence schedule. Its purpose is to give the buyer enough timely information to assess impact, meet its own duties and decide whether continued use remains acceptable.
Article 73 of the AI Act sets reporting and investigation requirements for serious incidents involving relevant high-risk AI systems. The provision includes different outer reporting periods depending on severity and permits an initial incomplete report when needed for timely notification. Contracting parties should confirm applicable dates, scope and responsibilities for their circumstances.
1. Define notification triggers broadly enough
Require notice for suspected as well as confirmed events that may materially affect safety, fundamental rights, legal compliance, confidentiality, integrity, availability, accuracy, transparency or the buyer's approved use.
Include near misses and recurring lower-severity failures where they reveal a control weakness. State that contractual notification does not depend on the supplier first concluding that a statutory serious-incident threshold has been met.
2. Set an early initial-notice clock
The buyer needs an early warning before the investigation is complete. Set a clear contractual period from awareness for an initial notice, with faster escalation for potential widespread infringement, severe harm or material service risk.
Allow the initial notice to be incomplete, but require known facts, confidence levels, immediate containment, a named incident lead and the time of the next update. Do not let an undefined requirement for certainty delay notification.
3. Require a minimum incident data set
The notice should identify the affected product and feature, model and system version, intended use, incident time and discovery time, affected customers and geographies, suspected impact, relevant inputs and outputs, upstream providers, safeguards that operated or failed, and current containment.
Require the supplier to distinguish confirmed information, preliminary assessment and unknowns. Each update should retain the previous version so the buyer can reconstruct how the incident evolved.
4. Preserve evidence and the evaluation trail
Specify preservation of logs, prompts, configurations, model identifiers, retrieval sources, evaluation results, human-review records, release approvals and relevant communications. Define retention, access controls and lawful disclosure routes before an incident occurs.
The AI Act states that a provider should not alter the relevant AI system in a way that could affect later evaluation of incident causes before informing the competent authorities. The contract should support preservation while still allowing documented emergency measures needed to prevent harm.
5. Define cooperation, updates and the final report
Set the update cadence, buyer contacts, secure exchange method and rules for regulator, insurer and customer communications. Require reasonable access to subject-matter experts and relevant upstream evidence, while respecting privilege, security and other customers' confidentiality.
The final report should cover root cause, impact, affected versions, control failures, corrective actions, residual risk, recurrence testing, regulator notifications and customer actions. Require evidence that remediation was tested, not only a statement that the issue was closed.
6. Connect incidents to change control and exit rights
Define which corrective changes require buyer approval, renewed testing or an updated risk assessment. Connect the incident record to the supplier change log, AI inventory and contract review so the original procurement decision does not remain frozen in time.
Include proportionate rights to restrict use, suspend an affected feature, obtain transition support or terminate where severe or repeated incidents make the approved use untenable. Legal counsel should adapt the schedule to the service, bargaining position and governing law.
For the companion operating control, read our supplier change-log guide. AI Act Ready helps procurement and governance teams build the evidence requirements behind their AI contract clauses.