Question

To ask the Secretary of State for Digital, Culture, Media and Sport, which body an AI developer should notify of an incident in which an AI system affects an organisation in the UK.

The appropriate reporting route depends on the nature of the incident. For example, incidents involving personal data may need to be reported to the Information Commissioner’s Office, while qualifying serious incidents involving AI medical devices must be reported to the Medicines and Healthcare Products Regulatory Agency. AI developers must also satisfy themselves that they have met any reporting duties under their contractual requirements. For cyber incidents, AI developers should promptly and transparently notify affected organisations, including government and public sector bodies, using the GOV.UK signposting tool at https://www.gov.uk/guidance/where-to-report-a-cyber-incident.