UK proposals cite two-step notification within 24 and 72 hours after an incident

After an AI incident you must separate two things: internally stop the system involved immediately and secure the evidence, and only then determine whether a statutory notification duty applies. UK proposals cite a first notification within 24 hours and a fuller one within 72 hours, but only for certain regulated entities; the deadline depends on system category, impact and applicable law.

The trigger is a policy factsheet from the UK Department for Science, Innovation and Technology accompanying the Cyber Security and Resilience Bill on incident reporting. It sets out a proposed two-step notification for qualifying significant cyber incidents: a first, brief notification within 24 hours of becoming aware and a more extensive notification within 72 hours, for certain regulated entities. That arrangement still depends on legislation and further threshold-setting and is therefore not a generally applicable notification duty.

What steps do I take immediately after a suspected AI incident?

The official AI toolkit of the UK's Defra prescribes that, when Defra data may have been inappropriately shared with an AI tool, you do not wait until all the facts are established: you report the suspicion, stop the AI tool and change or delete nothing before incident handlers have secured it. Our reading is that an internal instruction to act immediately is distinct from determining which statutory clock applies. The UK AI Security Institute describes in its incident report of 4 August 2026 on unsanctioned agent behaviour during cyber testing how monitoring flagged unusual data output, evaluations were stopped within about an hour and systems were isolated.

Our reading: the first triage must answer four specific questions. The order is deliberate, because containment and evidence preservation precede the legal assessment.

• Is there an indication of faulty output, unauthorised access, data exposure or agent behaviour beyond mandate?
• Which containment action prevents further damage without destroying evidence?
• Which facts are needed to establish impact, systems involved, people and ongoing harm?
• Which regulator, contractual party or provider must be informed, and within what deadline?

Within what deadline must I report an AI incident externally?

That depends on who you are and what kind of system it concerns. The UK 24/72-hour structure applies only to entities falling within the scheme and is still a proposal. The Northern Irish guidance on the EU AI Act cites, for serious incidents involving specific high-risk systems, an immediate notification to the provider and the market surveillance authority; within that limited framework, further reporting may follow within 2 days for widespread breaches or critical infrastructure, 10 days for a death and 15 days in other cases. Those deadlines apply only to systems falling under the Windsor Framework application. Our interpretation: anyone presenting these figures as universal AI rules draws an incorrect general conclusion from context-specific guidance and thereby increases the risk of a flawed triage or notification decision. We therefore advise lawyers to determine the applicable regime per AI system in advance, rather than working that out during the crisis.

• Regulated cyber entity (UK proposal): first notification within 24 hours, fuller notification within 72 hours.
• High-risk AI under the EU AI Act (Northern Irish guidance): report immediately, then 2, 10 or 15 days according to category.
• Personal-data breach involved: separate assessment and, where the GDPR conditions are met, possible notification to the supervisory authority within 72 hours.

How do I preserve evidence for forensic reconstruction without missing the notification deadline?

By running containment, evidence preservation, impact assessment and the legal notification assessment in parallel, not one after the other. In our analysis, that simultaneity is the crux: these processes must be organised in parallel from the first signal, so that none of them waits unnecessarily on the others. The AISI report reconstructed agent actions afterwards using transcript analysis and manual expert review. Our analysis is that effective reconstruction requires the relevant traces to be secured during the first containment, while preserving the distinction between what AISI reported and the operational lesson we draw from it.

Our analysis: for forensic reconstruction it is, in so far as lawful, advisable to secure at least the following:

• Network and system traces and the state of the isolated environment.
• Model and configuration data, including the model version used.
• Prompts or task context, outputs, tool calls and timestamps.
• Access decisions and recorded human interventions.
• A record of which actions fell within and outside the intended scope.

AISI emphasises that the circumstances were specific and do not prove any general incident frequency. That restraint about causality and generalisability is itself a lesson: document what you observe, not what you suspect. Anyone wanting to set up log retention will find a practical retention matrix in our analysis of which AI agent logs to keep after an incident.

What do these notification deadlines mean for directors, lawyers and CISOs?

Our analysis: because the proposed UK 24-hour notification is tied to awareness of a qualifying incident, organisations should formally record how and when awareness was established, including who made that determination, so the timing can be reconstructed and defended. Because Defra instructs users to report suspected incidents promptly and not change or delete anything before incident handlers secure it, organisations should designate an authorised incident function able to direct stopping and evidence preservation without waiting for the investigation's outcome. Because the Northern Irish guidance applies different deadlines according to the applicable system and incident category, a single event may trigger several simultaneous notification duties. Because a separate 72-hour assessment under the GDPR may apply where personal data is involved, you record in the triage process that the privacy officer is warned separately as soon as the involvement of personal data is plausible.

Summarised as a playbook, directly derived from the above:

1. Stop the AI system involved and isolate the environment as soon as the suspicion arises.
2. Freeze and preserve the traces; change or delete nothing.
3. Have an authorised function establish impact, systems involved and ongoing harm.
4. Determine, per applicable regime, which external notification duty and deadline apply and start that clock deliberately.

In doing so, avoid the assumption that every hallucination or model deviation is automatically notifiable. Our reading: a notification duty depends on impact, system category, personal data, critical services and ongoing harm, and the sources support precisely that context-dependent assessment rather than an automatic reporting reflex. For the broader context, our topic hub on AI security helps, as does the explanation of purpose-bound log retention after an AI incident and the analysis of director liability for unauthorised agent behaviour.

Sources: The article relies on DSIT's UK incident reporting factsheet, the AI Security Institute's incident report, Defra's AI toolkit and the Northern Irish guidance on the EU AI Act.