An AI agent failure is an ICT-related incident under DORA when it adversely affects the availability, authenticity, integrity or confidentiality of data, or the services the entity provides. Every such incident must be recorded and classified; major ones are reported to the supervisor in stages. To report well, capture what the agent did, to whom, from when, and why.
What does DORA require on incidents, in plain words?
DORA (Regulation (EU) 2022/2554), applying from 17 January 2025, requires financial entities to run an ICT-related incident management process. In substance, they must:
- detect, manage and record all ICT-related incidents and significant cyber threats;
- classify incidents using DORA's criteria to decide which are major;
- report major incidents to the competent authority through an initial notification, an intermediate report and a final report;
- inform clients without undue delay where a major incident affects their financial interests, and explain the measures taken;
- identify root causes and prevent recurrence.
DORA defines an ICT-related incident, in substance, as an unplanned event or series of linked events that compromises the security of network and information systems and has an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the entity's services. For the classification step, see DORA major ICT incident classification for agent failures, and for background, what DORA is.
Who has to report?
Financial entities within DORA's scope, whether the agent runs in-house or on a vendor's platform. If the vendor's platform fails, the entity still reports its own incident, which is why contracts must require vendors to assist with ICT incidents.
Entities outside the financial sector that are essential or important under NIS2 face a different reporting regime, described in NIS2 incident reporting when an AI agent is involved.
When is an agent failure an ICT incident?
The integrity limb does most of the work for agents. Consider four situations.
The platform goes down. Agents stop, customers wait. That affects availability of services and is plainly an ICT incident.
The agent acts wrongly. A collections agent applies the wrong fee rule to a batch of accounts, or a payments agent releases transfers based on details lifted from an emailed invoice. Data and services have lost integrity. This is an ICT incident even though every server ran perfectly.
The agent is manipulated. Hidden instructions in a document lead the agent to disclose customer data. Confidentiality is compromised; it is an incident and possibly a personal data breach as well.
A control fires as designed. An agent fails its certification run and drops to read-only. The control working is not, by itself, an incident. But if the failure shows the agent was producing wrong outcomes in live work before the run, those outcomes are. The link between the two is covered in what happens when an AI agent fails certification.
What should you capture to report it?
Reports need facts quickly and accurately. For agent incidents, the facts sit in the agent's action record. Capture:
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Detection and recording | Thresholds on agent behaviour raise incidents, not just infrastructure alerts | Incident record opened with detection source |
| Time of occurrence and detection | Action record shows when wrong behaviour started, not only when noticed | Timeline built from timestamped actions |
| Scope of impact | Every case, client and transaction touched in the window identified | Case list drawn from the record |
| Data affected | Records changed or disclosed identified by action | Data impact list |
| Agent state | Agent, capability, version, model and depth at the time | Version and configuration snapshot |
| Classification | Assessment against DORA criteria | Classification record |
| Reporting | Initial, intermediate and final reports prepared from the record | Reports filed |
| Client communication | Affected clients informed where required | Client notices sent |
| Root cause and remediation | Cause found; bounds, sources or tests changed | Root cause analysis and change records |
The scope row is where agent incidents differ most. With people, wrong work tends to be scattered. With an agent, it is systematic: every case in a window, or every case of one type. If you cannot list them from your record, you will under-report or over-report. The response process itself is covered in how to handle an AI agent incident.
What will a supervisor ask?
- When did the agent start behaving wrongly, and how do you know?
- How many clients and transactions were affected?
- Why did your monitoring not catch it sooner?
- What version of the agent and model was running?
- Was the cause in your configuration, your sources or the vendor's model?
- What have you changed to stop it happening again?
What does DORA incident reporting not cover?
It does not replace personal data breach notification under GDPR, which runs on its own test and timeline. It does not cover serious incident reporting under the EU AI Act for high-risk systems, which may also apply. It does not cover incidents with no ICT element, such as a staff member misusing an agent's output by hand. For how these overlap, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme files every agent action with its time, capability, version, sources and verdict in an append-only record. When an incident starts, that record answers the questions a report needs: when the wrong behaviour began, which cases and clients it touched, and which bound should have stopped it. Agents can be dropped to read-only while the facts are gathered.
Questions people ask
Is an agent giving a wrong answer to one customer an ICT incident?
A single error may be an operational mistake rather than an incident. A pattern of wrong outcomes, or one wrong action with significant effect, is more likely to meet the definition. Record it either way and assess.
Who reports if the vendor's platform caused the incident?
You do. The vendor must assist under the contract, but the financial entity reports its own incident to its supervisor.
Can one event trigger several reports?
Yes. An agent disclosing customer data could require a DORA report, a GDPR breach notification and, for a high-risk system, an AI Act serious incident report. Plan one response that feeds all three.