NIST AI RMF, ManageMANAGE 4.3

Upon discovering illegal content your generative AI service has produced, promptly stop generating it, stop transmitting it, eliminate it, carry out rectification such as retraining the model, and report it to the relevant competent authority, all under the same 'promptly' standard the text sets from the moment of discovery.

Preserve records of that user's illegal activity and report it to the relevant competent authority. The text sets no promptness standard or deadline for this second reporting duty, stating only that it follows discovery.

Upon discovering illegal or undesirable information, take disposal measures and preserve relevant records in accordance with law, and promptly report the discovery to the cyberspace administration department and the relevant competent authority. The text marks only this reporting step as prompt, counted from the moment of discovery, and states no separate promptness standard for the disposal and record-keeping steps that precede it.

Keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving your model and any corrective measures you have taken or plan to take. The Regulation states no fixed number of days for this report and no explicit moment its clock starts from, only that it must be made without undue delay.

Where you are an economic operator concerned by the bringing into conformity, recall or withdrawal of a high-risk AI system that is a safety component of a product or equipment covered by Chapter VII of Title V of Book V of the Code de l'environnement, inform the other economic operators you supplied, and the operators and users of the system (Article 24 quater, 4°, b)).

Report a critical safety incident to the Agency, the Illinois Emergency Management Agency and Office of Homeland Security, and to the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that a critical safety incident has occurred.

Within 24 hours of discovering that a critical safety incident poses an imminent risk of death or serious physical injury, disclose it to an appropriate authority, including a law enforcement or public safety agency with jurisdiction over it.

If you are a frontier developer, report a critical safety incident to the attorney general within 15 days of discovering it, and within 24 hours to an appropriate authority when the incident poses an imminent risk of death or serious physical injury.

Build a risk-management system that monitors and responds to AI-related safety accidents involving your system.

If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.

Inform the distributors of the system and, where applicable, its deployers, your authorised representative and importers accordingly.

Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.

Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.

Where you have identified a serious incident, immediately inform first the provider, then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, report the incident yourself as Article 73 requires of a provider.

If you consider or have reason to consider that the system is not in conformity with the Regulation, take the necessary corrective actions and provide the information Article 20 requires.

If you test a high-risk AI system in real-world conditions outside an AI regulatory sandbox, report a serious incident identified in the course of the testing to the national market surveillance authority in accordance with this Article; Article 60(7) applies this from 2 August 2026.

If your high-risk AI system is placed on the EU market and you are its provider, report any serious incident to the market surveillance authority of the Member State where the incident occurred.

Report any serious incident identified in the course of the testing to the national market surveillance authority in accordance with Article 73, which requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after you become aware of the incident, not later than two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, and not later than 10 days after you become aware of it where a person has died (Article 60(7)).

If a serious incident occurs in your AI system and you are its developer or provider, urgently apply technical measures to remedy, suspend, or recall the system, and at the same time notify the competent state authority of the incident.

If a serious incident occurs in your AI system and you are its deployer or user, record the incident, notify it promptly, and coordinate with the other parties during the remediation process.

The CBJ expects you to maintain a central AI Incident Registry and to notify FinCERT or the CBJ promptly of AI-related incidents in accordance with any CBJ instructions (section 6.1).