Rights & Ethics

Incident

Adverse effect or material risk to fundamental rights from AI operation.

How the laws define this

Regulators consistently treat an incident as an adverse event, threat, or failure that triggers legal obligations such as reporting to authorities and taking corrective or response actions. However, these instruments diverge sharply on the specific harms or conditions required to constitute an incident. Under Proyecto de Ley (Boletín 17112-19), an incident centers on adverse effects or material risks to fundamental rights arising from AI operations. By contrast, Proyecto 255/24 limits incidents to traffic accidents, near-misses, or hazards detected or predicted by an AI system. Taking a network security approach, the National Cybersecurity Strategy 2021–2025 defines incidents around breaches, attacks, or failures that compromise the confidentiality, integrity, or availability of networks, data, or information systems. Finally, the Draft Bill: Anteproyecto de Ley for the Good Use and Governance of Artificial Intelligence sets a high threshold of physical and operational harm, defining incidents as occurrences that result in death, critical infrastructure failure, or major environmental damage.

Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Chile	Bill (Bulletin 17112-19) — Establishes limits on AI development to protect fundamental human rights	Under Review	Adds obligations like incident reporting, mandatory remediation, and potential administrative or civil liabilities triggered by the adverse effect or risk.
Spain	Organic Law Bill for the Good Use and Governance of Artificial Intelligence	Under Review	Limits incidents to severe occurrences involving death, critical infrastructure failure, or major environmental damage.
Colombia	Project 255/24: Guidelines for the Use of AI to Reduce Road Accidents	Withdrawn	Restricts to traffic accidents, near-misses, or hazards detected or predicted specifically by AI systems in road safety contexts.
Slovakia	National Cybersecurity Strategy 2021–2025	Superseded	Broadens to any cybersecurity-related breach, attack, failure, or threat to networks, systems, or data confidentiality, integrity, or availability.

What it triggers

In Chile's Bill (Bulletin 17112-19), it would trigger obligations such as incident reporting, mandatory remediation, and potential administrative or civil liabilities.source
In Spain's Organic Law Bill for the Good Use and Governance of Artificial Intelligence, it would require notification to competent authorities and retention of incident logs.source
In Colombia's Project 255/24, it would have triggered reporting to the lead authority, incident-response procedures, and potential system downgrades, suspensions, or corrective actions.source
In Slovakia's National Cybersecurity Strategy 2021–2025, it sets out reporting and response actions to authorities such as SK-CERT.source

Definitions (4)

An adverse effect or material risk to fundamental rights arising from the operation of an AI system, which triggers obligations such as incident reporting, mandatory remediation, and potential administrative or civil liabilities under the bill.

Proyecto de Ley (Boletín 17112-19) — Establece límites al desarrollo de la inteligencia artificial en resguardo de los derechos humanos fundamentales (Limits on AI development to protect fundamental human rights)Definition 1 of 4

An event classified as a traffic accident, near-miss, or hazard that is detected or predicted by an AI system; incidents trigger reporting obligations to the lead authority, incident-response procedures, and may prompt system downgrades, suspensions or corrective actions under the bill.

Proyecto 255/24: Lineamientos de uso de IA para la disminución de siniestros viales (AI for road-accident reduction)Definition 2 of 4

Any breach, successful attack, failure or event that compromises or poses a threat to the confidentiality, integrity or availability of networks, information systems or data, and which may trigger reporting and response actions to authorities such as SK-CERT.

National Cybersecurity Strategy 2021–2025Definition 3 of 4

An occurrence that results in death, the failure of critical infrastructure, or major environmental damage; the draft law requires notification of grave incidents to competent authorities and the retention of incident logs to support enforcement and liability assessments.

Draft Bill: Anteproyecto de Ley for the Good Use and Governance of Artificial Intelligence (Anteproyecto de Ley para el buen uso y la gobernanza de la Inteligencia Artificial)Definition 4 of 4

Not to be confused with

AI Incident

'AI Incident' focuses on events where AI causes or nearly causes harm or violations warranting investigation, while these definitions vary by context like rights, severity, or cybersecurity.

AI-Related Harm

'AI-Related Harm' specifies actual damage to life, health, property, or interests, whereas 'incident' here covers risks, threats, or events without requiring realized damage.

Questions and answers

What obligations does an AI incident trigger in Chile?

Under Chile's Bill (Bulletin 17112-19), an incident triggers incident reporting, mandatory remediation, and potential administrative or civil liabilities. This applies to adverse effects or material risks to fundamental rights from AI operation.

What counts as an incident under Spain's AI bill?

Spain's Organic Law Bill defines it as occurrences resulting in death, critical infrastructure failure, or major environmental damage. Such grave incidents would require notification and log retention.

How is incident defined in Slovakia's cybersecurity strategy?

Slovakia's National Cybersecurity Strategy 2021–2025 defines it as any breach, attack, failure, or event threatening confidentiality, integrity, or availability of networks, systems, or data. It describes reporting to SK-CERT.