What Is an AI Incident?

As AI spreads through business and daily life, so do the moments when it goes wrong, and those moments now have a name and a growing paper trail. The OECD's global monitor for these events has already logged thousands of them (Source: OECD.AI). But what actually counts as an "AI incident," and why is the term suddenly appearing in regulations and boardroom risk discussions? This guide gives you a clear answer, along with the distinction that trips people up, real examples, and the reporting rules businesses now face. (For related context, see our guide on preparing for EU AI Act compliance.)

An AI incident is not just a bug or a bad output. It is the point where an AI system causes real harm, and treating those moments as reportable events, rather than quietly patching them, is fast becoming both good practice and the law.

What Is an AI Incident?

An AI incident is an event where an AI system causes harm. The most widely used definition comes from the OECD, which describes an AI incident as an event, circumstance, or series of events where the development, use, or malfunction of one or more AI systems directly or indirectly leads to harm (Source: OECD.AI). Those harms can include injury to people, damage to property or the environment, or the infringement of human rights such as privacy and non-discrimination.

The other leading reference, the AI Incident Database, frames it slightly more broadly as an alleged harm or near-harm event to people, property, or the environment where an AI system is implicated (Source: AI Incident Database). Researchers note there is still no single agreed definition across the field, but these two capture the core idea: something went wrong, an AI system was involved, and harm resulted or nearly did (Source: arXiv).

Incident vs. Hazard: A Distinction That Matters

One distinction is worth getting right, because regulators and monitors rely on it. An AI incident involves actual harm that has already occurred. An AI hazard, by contrast, is an event where an AI system could plausibly lead to harm but has not yet caused it, capturing potential harm rather than realized harm (Source: OECD.AI). A self-driving car that injures a pedestrian is an incident; a flaw discovered in that car's software before anyone is hurt is a hazard. The difference shapes how events are tracked and how urgently they must be addressed, and the OECD's monitor lets you filter for either.

What AI Incidents Look Like

AI incidents span a wide range of harms. They include biased hiring or lending tools that discriminate against protected groups, facial recognition systems that misidentify people, chatbots that give harmful or false information, deepfakes used to defraud or defame, and safety failures in AI-driven vehicles or medical tools. A concrete case: when an airline's chatbot gave a customer wrong information about fares, a tribunal held the company liable, a clear example of an AI system causing real harm and real consequences (Source: American Bar Association). The common thread is that a system behaving contrary to its intended purpose, or being used in a harmful way, produced a bad outcome for real people.

Why AI Incidents Matter, and the Rise of Reporting

As AI use grows, so do incidents and hazards, which is why a global movement to track and report them has taken off (Source: OECD.AI). Public repositories like the AI Incident Database and the OECD AI Incidents Monitor collect these events so that operators and policymakers can learn from failures and work to prevent them. The logic is captured in the OECD's phrase "name it to tame it": clear, shared definitions are the foundation for systematically reporting, analyzing, and heading off future harm (Source: OECD.AI).

Reporting is also becoming mandatory. Under the EU AI Act, providers of high-risk AI systems must promptly notify national authorities of serious incidents, and the law defines a serious incident as one that directly or indirectly leads to a serious outcome, such as death or serious harm to health, disruption of critical infrastructure, infringement of fundamental rights, or serious harm to property or the environment (Source: Latham & Watkins). This obligation, set out in Article 73, comes with follow-up investigations and corrective measures (Source: EU Artificial Intelligence Act, Article 73). In short, AI incidents are shifting from something companies quietly fix to something they may be legally required to disclose.

What Businesses Should Do

For any organization using AI, a few steps follow directly. Know what counts as an incident, so your teams can recognize one when it happens rather than dismissing it as a glitch. Put a process in place to detect, log, and investigate incidents, and to report serious ones where the law requires it. Learn from each event by tracing its root cause and fixing the underlying problem, not just the symptom, and keep humans accountable for AI-driven decisions, since responsibility for harm stays with your organization. Grounding this in a recognized approach such as the voluntary AI Risk Management Framework from the US National Institute of Standards and Technology helps turn incident response into a repeatable discipline (Source: NIST).

The Bottom Line

AI incidents are the flip side of AI's rapid adoption, and with roughly one in five US workers now using AI on the job, the surface area for things to go wrong keeps expanding (Source: Pew Research Center). As organizations weave AI deeper into their operations (Source: McKinsey), understanding what an AI incident is, distinguishing it from a hazard, and building the habit of reporting and learning from these events is becoming a core part of using AI responsibly, and a genuinely valuable skill (Source: World Economic Forum). Naming these failures is the first step to preventing the next one.