Reporting major ICT-related incidents. Financial entities are obligated to promptly report major ICT-related incidents to the competent authorities (Article 19 of DORA). This reporting obligation may also include incidents in AI systems. Rapid response mechanisms are necessary because, for example, the manipulation of AI systems can cause significant operational harm in a short period of time.
Entities must develop a policy for the ICT-related incident management process. Ideally, this policy should also address AI systems. Likewise, technical, organisational and operational mechanisms to support the ICT-related incident management process should be implemented and operated (Article 22 of the RTS RMF).
Incidents that occur due to or in connection with ICT systems, such as AI systems, that compromise the security of network and information systems and breach IT protection objectives for data or negatively impact services provided must be recorded as ICT-related incidents (Article 17 of DORA). In this context, entities are encouraged to identify incidents related to AI systems accordingly.
When using AI systems in the cloud, entities are encouraged to make arrangements for reporting ICT incidents that occur in AI systems. Entities should also make sufficient qualified internal resources available for assessment and response.
Best practices for incident management include:
- identifying AI-specific threats (e.g. manipulation of training data);
- detecting ICT incidents arising from AI systems so that immediate action can be taken in response to e.g. model errors, data loss or performance problems;
- impact analysis (e.g. data loss) of ICT incidents arising from AI systems and classification of severity levels;
- integration of such incidents into the general incident response policy.
After such incidents, a detailed root cause analysis is recommended to identify and remedy systematic weaknesses in AI models and processes. These findings can be used in continuous improvement measures to sustainably prevent repeated ICT incidents in AI systems.