> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ayliea.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident Tracking

> Report, investigate, and resolve AI-related incidents

<Note>
  Incident Tracking is included based on your engagement scope. Contact your Ayliea engagement lead to confirm it's part of yours.
</Note>

Incident tracking gives your team a structured process for managing AI-related failures, harms, and near-misses from first report to formal closure. Every incident produces a documented record with investigation findings, remediation steps, and regulatory notifications — giving you the audit trail that regulators and auditors expect.

## Reporting an incident

To report a new incident:

1. Navigate to **Governance → Incidents** and select **Report Incident**
2. Enter a title and a description of what occurred
3. Set the severity — Critical, High, Medium, or Low
4. Select a category (for example, bias/fairness, data breach, model failure, or safety violation)
5. Optionally link the incident to one or more registered AI systems
6. Select **Submit**

Once submitted, the incident is assigned an ID and enters the **Open** status.

## Incident lifecycle

Incidents move through a defined lifecycle:

| Status            | Meaning                                                             |
| ----------------- | ------------------------------------------------------------------- |
| **Open**          | Reported but investigation has not started                          |
| **Investigating** | Actively gathering information about the cause                      |
| **Containment**   | The immediate impact is being limited while investigation continues |
| **Remediation**   | Root cause identified; fixes are being implemented                  |
| **Resolved**      | Remediation complete; incident is functionally over                 |
| **Closed**        | Formally closed with a closing note on record                       |

Status transitions are recorded in the incident timeline with a timestamp and the name of the person who made the change.

## Investigation fields

During investigation, you can record:

* **Root cause** — a narrative description of what caused the incident
* **Root cause category** — a structured label (for example, training data quality, deployment error, or prompt injection)
* **Contributing factors** — additional conditions that made the incident worse or harder to detect

These fields are optional while an incident is open, but must be completed before an incident can move to Remediation.

## Remediation tracking

The Remediation section of each incident tracks the steps your team is taking to fix the underlying cause and prevent recurrence:

* **Remediation steps** — a list of actions with completion status
* **Preventive measures** — controls or process changes being put in place to reduce the likelihood of recurrence

## Regulatory notification management

For incidents that trigger regulatory reporting obligations, the notification tracker lets you record:

* Which regulators must be notified
* The notification deadline for each
* Whether the notification has been sent and when

<Warning>
  Regulatory notification deadlines under the EU AI Act and other frameworks can be as short as 72 hours for certain incident categories. Configure notifications as soon as you determine a regulatory obligation applies.
</Warning>

## Timeline

Every incident has an automatic activity feed that records all status changes, field updates, and comments in chronological order. The timeline cannot be edited — it is an accurate record of exactly how the incident was handled.

Team members with access to the incident can add comments to the timeline to document decisions, share findings, or communicate status.

## Closing an incident

To close an incident, select **Close Incident** from the incident detail view. Closing requires a written closing note summarizing the outcome and any open follow-up actions. The closing note is appended to the timeline and the incident moves to **Closed** status.

Closed incidents remain visible and fully searchable. They cannot be reopened, but a new incident can reference a closed one if the same issue recurs.

## Preventive recommendations

When an incident is resolved, Ayliea generates a set of preventive recommendations based on the root cause and contributing factors recorded. These recommendations appear in the incident record and can be linked to your assessment remediation backlog so the underlying control gap gets addressed as part of your regular improvement cycle.