Monday morning, 7:43 am: over the weekend your AI agent autonomously synced customer data into the wrong system, or was tricked via prompt injection into leaking credentials. The first question is no longer just "how do we stop this?" but also: "is our 24-hour clock already running?"
Start with two checks: is your organisation covered, and is the incident significant? For covered German entities, section 32 BSIG sets the reporting stages. An AI agent can cause or enable a reportable incident, but an agent error alone does not establish a reporting duty.
Short answer
- Yes, an AI agent incident is NIS2-reportable if your company falls under NIS2 and the incident is significant.
- The obligation is cause-neutral: what counts is the impact (service disruption, financial damage, data exfiltration), not the perpetrator.
- An agent error, compromised identity or prompt injection can trigger reporting when the applicable significance criteria are met.
- Report without undue delay: within 24 hours and 72 hours of awareness of a significant incident. The final report is generally due within one month after the 72-hour report.
The three NIS2 reporting deadlines at a glance
| Stage | Deadline | Content | Recipient |
|---|---|---|---|
| Early warning | Within 24h of awareness of a significant incident | Suspicion, whether intentional/unlawful, possible cross-border impact | BSI (reporting portal) |
| Follow-up | Within 72h of awareness of a significant incident | Initial assessment: severity, impact, indicators of compromise (IoCs) | BSI |
| Final report | Within 1 month after the 72h report | Detailed description, root cause, countermeasures, cross-border effects | BSI |
The early warning is a first notification, not a completed investigation. Do not wait for root-cause certainty once the reporting threshold is met. Record the awareness time, impact assessment and information available at each stage. For an ongoing incident, section 32 provides for a progress report followed by a final report after handling is complete.
Why AI agents make the reporting obligation harder
Problem 1: when does "awareness" start for an autonomous system?
Record when your organisation became aware of a significant incident and how it reached that assessment. An agent alert is evidence to investigate; it is not automatically the legal start time. Define escalation rules so security, operations and the reporting owner can assess significance promptly.
Problem 2: is it even a "security incident"?
Loss of confidentiality, integrity or availability can be a security incident. Reporting under section 32 additionally depends on scope and significance. Assess severe operational disruption, financial loss and material or non-material harm to others against the statutory definitions and applicable sector criteria.
Problem 3: the forensics gap
Preserve tool-call history, agent identity, relevant permission snapshots and available indicators of compromise. Retain prompts and outputs only where necessary and appropriate, with redaction and access controls for personal data and secrets. State what is known and what remains under investigation in the follow-up.
Problem 4: double and triple reporting duties
Assess other reporting regimes separately. A personal-data breach may also require notification under GDPR Article 33; not every involvement of personal data triggers notification. AI Act obligations depend on system classification, your role and the applicable start date. Check the European Commission’s current AI Act timetable rather than treating August 2026 as a universal start date for high-risk obligations.
Checklist: making your incident response agent-ready
- Add AI agents to the incident playbook. Define "agent causes incident" and "agent gets compromised" as distinct scenarios with owners and escalation paths.
- Document detection and awareness. Keep alert timestamps, assessment decisions and escalation records. Make the responsible person reachable outside office hours.
- Prepare agent forensics. Preserve relevant tool calls, credential identifiers and permission snapshots. Redact secrets and restrict access to investigation records.
- Test safe containment. Define how to pause tasks, revoke access and isolate the agent. In operational environments, coordinate shutdown with safety and continuity procedures.
- Clarify reporting responsibilities. Assign owners for BSI reporting and separate assessments under data-protection and AI rules. Rehearse the handoffs.
- Maintain an agent inventory. You can only report what you can attribute. Every agent needs an owner, a purpose and documented permissions; see our guide to non-human identities.
- Run a tabletop exercise with an AI scenario. Rehearse significance assessment, reporting and recovery with management, security and operations.
On Elmoz
Frequently asked questions
Do I have to report if a vendor's AI agent caused the incident?
It can be reportable if your organisation is covered and the incident meets the applicable significance threshold. A vendor’s involvement does not remove your own obligations. Agree evidence-sharing and escalation duties with the vendor.
Does the reporting obligation apply to internal incidents without an attacker?
Yes. A purely internally caused outage (an agent deleting production data) can be a significant security incident. Intent or external attackers are not a prerequisite.
What happens if I do not report?
Failure to meet an applicable reporting obligation can lead to enforcement and penalties. Consequences depend on the provision, entity category and facts; the maximum for another infringement should not be presented as an automatic fine for a missed notification.
Conclusion: the deadline does not ask who caused the incident
An agent does not change the core decision: establish whether your organisation and incident fall within the reporting rules, then act within the applicable deadlines. Logging, clear ownership and a tested containment process help your team prepare an evidence-based report.
Next step: check today whether your incident response playbook contains the words "AI agent" at all. If not, you know what this week looks like. Elmoz gives you the agent inventory and reach map that a credible report is built on.