Examples
Examples from published documents
- After its evaluation-sandbox incident OpenAI organised its response around "four core pillars: Security and containment; Monitoring; Alignment; and Incident response" (OpenAI/Hugging Face Incident Technical Report, §I)
- UK AISI said it would treat internet access in cyber ranges "as one that must be actively justified rather than a default" and introduce monitoring "able to flag or block out-of-scope actions as they happen" (UK AI Security Institute, Incident Report, 4 Aug 2026)
Counter-examples
Not to be confused with
- Containment is not corrective action: terminating runs or disabling credentials stops an incident, while a corrective action changes the conditions that allowed it.
- A report of what happened is not a corrective action; the EU Code lists the response taken as its own field, separate from the description and the root cause analysis.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Root cause analysis
- Root cause analysis is the investigation of why an AI incident happened, covering the model outputs that led to it, the inputs and any failed or circumvented safeguards. The EU Code of Practice lists it among the information a serious incident report must contain.
- Source: EU GPAI Code of Practice, Safety and Security Chapter
- Post-mortem
- Post-mortem is a review held after an incident to learn what went wrong and what should change. xAI's framework describes one focusing on any areas where changes to systemic factors could have averted the incident.
- Source: xAI Frontier AI Framework, 30 June 2026
- Blameless postmortem
- Blameless postmortem is an incident review that looks for causes and fixes rather than individuals to blame. Anthropic invoked a blameless postmortem culture after its 2026 evaluation incidents while treating the fixes as its own responsibility.
- Source: Anthropic -- Investigating Incidents (cybersecurity evals)
- After-action review
- After-action review is a structured review after a significant incident that records lessons and required fixes. Anthropic's Advanced AI Framework proposes binding after-action reviews after nationally significant biological incidents, with public reporting and corrective-action deadlines.
- Source: Anthropic Advanced AI Framework
Source of record
Where this definition comes from
EU AI Act (Regulation (EU) 2024/1689), Article 55, Art. 55(1)(c)
“Providers shall "keep track of, document, and report, without undue delay, to the AI Office and, as appropriate, to national competent authorities, relevant information about serious incidents and possible corrective measures to address them".”
https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-55EU GPAI Code of Practice, Safety and Security Chapter, Measure 9.2(6), (8)
“Signatories report "(6) what, if anything, the Signatory intends to do or has done in response to the serious incident" and "(8) a root cause analysis with a description of the model's outputs that (directly or indirectly) led to the serious incident and the factors that contributed to their generation, including the inputs used and any failures or circumventions of systemic risk mitigations".”
https://ec.europa.eu/newsroom/dae/redirection/document/118119OpenAI Frontier Governance Framework, §2.6, Investigation, mitigation, and response
“"The investigation includes determining the root cause, scope, and impact of the incident. Once the investigation has been completed, OpenAI takes steps to implement longer-term solutions to address root causes. As part of our commitment to preventing similar future incidents, we may also conduct a retrospective if needed to document key learnings and address open action items."”
https://cdn.openai.com/pdf/e37d949b-8c9f-4d76-b99e-4272f4631a7e/openai-frontier-governance-framework.pdf
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| EUShadow mapping EU AI Act (Regulation (EU) 2024/1689), Article 55(1)(c) | “"relevant information about serious incidents and possible corrective measures to address them" (Art. 55(1)(c)).” | exactEQ confidence: high | EU AI Act (Regulation (EU) 2024/1689), Article 55 |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Response taken (Measure 9.2(6)); root cause analysis (Measure 9.2(8)); an incident is 'resolved' once the Signatory "adopted corrective measures to rectify the harm, if possible, and to assess and mitigate systemic risks related to it" (Glossary).” | exactEQ confidence: high | EU GPAI Code of Practice, Safety and Security Chapter |
| EUShadow mapping EU AI Act (Regulation (EU) 2024/1689), Article 73(6) | “"the provider shall, without delay, perform the necessary investigations in relation to the serious incident and the AI system concerned. This shall include a risk assessment of the incident, and corrective action." (Art. 73(6))” Applies to providers of high-risk AI systems. | closeCL confidence: high | EU AI Act (Regulation (EU) 2024/1689), Article 73 |
| OpenAIShadow mapping OpenAI Frontier Governance Framework | “"longer-term solutions to address root causes"; optional "retrospective if needed to document key learnings and address open action items" (§2.6).” | closeCL confidence: high | OpenAI Frontier Governance Framework |
| OpenAIShadow mapping OpenAI/Hugging Face Incident Technical Report | “"OpenAI has organized its plan of action around four core pillars: Security and containment; Monitoring; Alignment; and Incident response" (§I); "These remediation efforts, along with the investigation more broadly, have been subject to review through OpenAI's established safety governance processes." (§IX)” | closeCL confidence: medium | OpenAI/Hugging Face Incident Technical Report |
| AnthropicShadow mapping Anthropic -- Investigating Incidents (cybersecurity evals) | “"Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we're approaching the fixes as if the responsibility were ours alone."” | closeCL confidence: medium | Anthropic -- Investigating Incidents (cybersecurity evals) |
| AnthropicShadow mapping Anthropic Risk Report (August 2026) | “"Each incident described below has prompted concrete improvements to our safeguards and processes, which we describe alongside it" (§4.5.8.2).” | closeCL confidence: medium | Anthropic Risk Report (August 2026) |
| UK AI Security Institute (AISI)Shadow mapping UK AI Security Institute -- Incident Report (4 Aug 2026) | “"We are treating this as a serious incident, warranting lasting change for AISI's evaluation protocols and security architecture." Listed changes: tighter internet-access controls, real-time monitoring, and reassessed evaluation design.” | closeCL confidence: high | UK AI Security Institute -- Incident Report: unsanctioned agent behaviour during cyber testing (4 Aug 2026) |
| xAIShadow mapping xAI Frontier AI Framework, 30 June 2026 | “Optional post-mortem "focusing on any areas where changes to systemic factors could have averted such an incident" (s.3).” The FAIF26 PDF's own metadata /Title reads "Privileged/Confidential DRAFT working FRAMEWORK DOC"; no xAI statement disambiguating draft vs. final status was found. Treat as draft provenance until resolved. | broadBR confidence: low | xAI Frontier AI Framework, 30 June 2026 |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- Anthropic
Proposes "binding after-action reviews following any nationally significant biological incident, with public reporting, statutory deadlines for corrective action, and independent oversight for unimplemented findings" (p.16): corrective action with a statutory deadline, for biological incidents only.
Anthropic Advanced AI Framework
Divergence
Where sources materially disagree
The EU makes corrective measures a reportable item and ties 'resolved' to their adoption; OpenAI, Anthropic and UK AISI publish corrective actions voluntarily in narrative form; xAI makes the post-mortem optional. No source requires a status or owner for each action.
Gap
No regime requires corrective actions to be tracked to completion with owners and dates; Anthropic's Advanced AI Framework proposes statutory deadlines for corrective action only after nationally significant biological incidents.
