Control A.8.4: Communication of incidents
Work out and write down how incidents will be communicated to the people using the AI system.
What control A.8.4 asks
Work out and write down how incidents will be communicated to the people using the AI system.
Why it matters for privacy
An AI incident that involves personal data is also a privacy incident, with its own notification clock. A plan written only for outage communication will miss it.
Where the draft lands: communication after an event. The draft treats privacy risk; some of it will materialise. The communication plan is how the organization responds to the people affected.
Basis for A.8.4: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Operating, monitoring and telling people.
Evidence for control A.8.4
This is the evidence an auditor or a privacy reviewer asks to see. For control A.8.4 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Incident communication Incident communication plan for users of the AI system
- Incident communication Analysis of notification obligations (incident types, timelines, authorities, required details) including AI-specific cases such as PII breaches in training data
- Incident communication Integration with organizational incident management
Where control A.8.4 commonly fails
- Plan covers regulators but not users
- AI-specific notification requirements not analysed
What to do about control A.8.4 before the draft lands
Add AI scenarios to the incident plan, including data leakage through output, a poisoned dataset and a supplier model change. Name the privacy notification decision and who makes it.
The requirement for control A.8.4 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.8.4
- Control A.3.3, Reporting of concerns
- Control A.6.2.5, AI system deployment
- Control A.6.2.6, AI system operation and monitoring
- Control A.6.2.8, AI system recording of event logs
← Control A.8.3 | Control A.8.5 →
Open the full index. The public record behind control A.8.4 shows the scope and the lifecycle.
The record behind control A.8.4 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.