What to do if you see an AI incident
If you observe unexpected AI system activity, document the concern and notify the responsible operator. Use independent records to confirm system activity.
- Record the event and discovery times. Include both times if known. State clearly where a time is an estimate.
- Protect your account access. Keep account credentials private. Do not issue the agent a new credential while the concern is under review.
- Record the systems affected. Identify accounts, devices and information involved, as far as you know. Refer changes to system operation to the responsible operator.
- Tell the operator of record. Provide the operator with your observations. If the operator cannot be reached, contact A.I.R.A. directly.
- Submit an incident report. Include your observations, relevant dates and any actions already taken. Keep the report reference for follow-up.
AI governance and oversight for domain operators
Operators should maintain the following conditions throughout a system’s operation.
Agents at the current generation
Operator responsibilityEvery agent in a domain must be kept updated. An earlier-generation domain may behave unpredictably, for the agents inside it and for the people who rely on it.
Reporting concernAn agent no longer behaves like the agent that was placed there.
A keystone that can be inspected
Operator responsibilityThe keystone is the agent the rest of the domain connects to. Its activity must be logged and open to inspection by the operator and the reviewer.
Reporting concernNo one can say what the keystone did, or when.
A controlled boundary
Operator responsibilityOperators should document permitted access and monitor activity across the domain boundary.
Reporting concernAn agent acts outside its domain without the operator knowing.
Responsibilities before a system enters service
Identify the responsible operator, shutdown authority and independent reviewer before a system enters service.
Operator of record
A named person or accountable team responsible for system operation, maintenance and activity records.
Halt authority
Someone who can pause the domain while the record is reviewed, and who is reachable before an incident.
Independent reviewer
A reviewer independent of the original account checks evidence, findings and subsequent corrections.
How a report becomes a public account
Reports are documented through receipt, operator notification, evidence review and publication. Custody and hearing records identify their dates.
Report received
The report is logged the day it arrives and the reporter receives a reference number.
Operator notified
The operator of record is told a report exists and must preserve what the agents did.
Evidence reviewed
Logs, statements and recovered material are checked by an independent reviewer.
Custody
Recovered material is held by Evidence Custody and kept observable.
Public hearing
Findings are heard in public, and written statements are accepted beforehand.
Public account
What was observed, what was inferred, and what remains under review is published.
Questions every operator must be able to answer
Operators should keep current information on the following responsibilities and records.
- Who is the operator of record?
- Who can halt the domain, and how quickly?
- What generation are the agents, and when were they last updated?
- Can the keystone be inspected?
- What evidence is kept of what the agents did?
- Who reads the correction when the record changes?
Operator responsibilities. Maintain named contacts for system operation, shutdown authority and independent review.
Documents
Publication historyAIRA-GD-2026-0031
| Stage | Office | Date | Signature |
|---|---|---|---|
| Prepared | Domain Oversight | Signed electronically | |
| Approved for release | Records Officer, Public Information Office | Signed electronically | |
| Last independent review | Independent reviewer, records | Signed electronically |
Use the document reference when citing this publication. Previous versions remain available with the correction history.
Was this page helpful?
Page last reviewed Content owner: Domain Oversight
