AI incident and complaint log for small EU businesses: one sheet for AI mistakes, customer complaints and serious incidents (EU AI Act, 2026)
What you get: a finished AI incident and complaint log you can paste into Google Sheets or Excel: one row for every AI mistake, customer complaint or "why did the AI decide this?" request, with what happened, who was affected, a triage level (A to D), who you told and when, your reply, and the date it was closed. Plus a four-level triage table, a who-to-tell-by-when table taken from Articles 26(5), 73, 85 and 86 of Regulation (EU) 2024/1689, and short reply wording you can reuse.
Why a small business should keep one now
- Anyone can complain to the authority. Under Article 85, any person who thinks the AI Act has been broken may complain to the relevant market surveillance authority. The Commission's AI Act Service Desk FAQ says national enforcement powers started on 2 August 2026 for the rules already in force, such as the prohibited practices and the Article 50 transparency rules (chatbot notices, deepfake labels).
- Serious-incident duties are coming for high-risk use. If you deploy a high-risk AI system (for example AI that screens job applicants or scores credit, see the Annex III check), Article 26(5) tells you to monitor it, suspend it and tell the provider and the authority when it presents a risk, and to report serious incidents. After the Digital Omnibus (Regulation (EU) 2026/1744), the high-risk rules for Annex III systems apply from 2 December 2027, and from 2 August 2028 for high-risk AI built into products under Annex I.
- A log is how you prove you reacted. When a customer, staff member or authority asks "what did you do when the chatbot gave wrong advice?", a dated row with the action and the closing date is a far better answer than memory.
Step 1: sort every report into one of four levels
| Level | What it looks like | What you do |
|---|---|---|
| A. Everyday error | Chatbot gives a wrong opening time; AI writing tool invents a product feature; AI translation garbles an email. Nobody harmed. | Fix it, note the fix, tell the tool's provider if it repeats. Close within your normal service time. |
| B. Complaint about how you use AI | "I didn't know I was talking to a bot." "This ad photo is fake." "Why was my application rejected by a computer?" | Reply to the person, check your chatbot notice or AI content labels, fix the gap, record the reply date. If it is an explanation request about a high-risk decision, see Article 86 below. |
| C. The tool may present a risk | A high-risk system used as instructed keeps producing results that could harm health, safety or people's fundamental rights, for example rejecting every applicant over a certain age. | For high-risk systems: suspend use, and without undue delay tell the provider or distributor and the market surveillance authority (Article 26(5)). For other tools: stop using it for that task and tell the provider. |
| D. Possible serious incident | An AI malfunction that directly or indirectly led to death or serious harm to health, a serious and irreversible disruption of critical infrastructure, a breach of EU law protecting fundamental rights, or serious harm to property or the environment (Article 3(49)). | Immediately tell the provider first, then the importer or distributor and the market surveillance authority (Article 26(5)). Keep the evidence and the system logs. Get legal advice. |
Most small businesses will only ever log level A and B rows. That is fine: the point is that you notice, act and can show it.
Step 2: who to tell, and by when
| Situation | Who acts | Deadline in the AI Act |
|---|---|---|
| You (deployer) identify a serious incident with a high-risk AI system | You inform the provider first, then the importer or distributor and the market surveillance authority | "Immediately" (Article 26(5)). The Commission's draft guidance of 26 September 2025 suggested reading this as within 24 hours; check the official source for the final guidance. |
| Provider reports the serious incident to the authority | Provider (or you, if you cannot reach the provider: Article 26(5) applies Article 73 to you) | Immediately, and no later than 15 days after becoming aware (Article 73(2)) |
| Widespread infringement, or serious and irreversible disruption of critical infrastructure | Same as above | No later than 2 days (Article 73(3)) |
| Death of a person | Same as above | No later than 10 days (Article 73(4)) |
| Not all facts known yet | Reporter | An incomplete initial report may be sent first, followed by a complete one (Article 73(5)) |
| High-risk system may present a risk (level C) | You tell the provider or distributor and the authority, and suspend use | "Without undue delay" (Article 26(5)) |
| Person affected by a decision based on an Annex III high-risk system asks why | You, as deployer, give a clear and meaningful explanation of the AI's role and the main elements of the decision | No fixed number of days in Article 86; reply promptly and log the date |
The Commission also published a draft serious-incident reporting template with that consultation. If you ever reach level D, ask the provider which authority and form to use in your country; national market surveillance authorities differ, so check the official source for yours.
The incident and complaint log (copy and fill in)
AI incident and complaint log · Business: [name] · Owner of this log: [name, role] · Reviewed: [monthly]
| No. | Date and time noticed | Reported by | AI system (as named in your AI inventory) | What happened | Who was affected | Level (A/B/C/D) | Action taken | Provider told (date) | Authority told (date, ref.) | Reply to person (date) | Closed (date, by) |
|---|---|---|---|---|---|---|---|---|---|---|---|
| [2026-01] | [dd/mm/yyyy hh:mm] | [customer by email] | [website chatbot, tool name] | [told customer returns are free; our policy says 14 days, paid] | [1 customer] | [A] | [honoured free return; corrected the bot's FAQ source] | [dd/mm, if repeated] | [n/a] | [dd/mm] | [dd/mm, name] |
| [2026-02] | [dd/mm/yyyy hh:mm] | [customer on social media] | [AI image tool] | [complained an ad photo looked real but was AI-made, no label] | [public] | [B] | [added "AI-generated image" label; row added to label sheet] | [n/a] | [n/a] | [dd/mm] | [dd/mm, name] |
| [2026-03] | [dd/mm/yyyy hh:mm] | [job applicant] | [CV screening tool] | [asked why the application was rejected automatically] | [1 applicant] | [B, Art. 86 request] | [human reviewed the file; explained the tool's role and the main reasons] | [dd/mm, asked for tool documentation] | [n/a] | [dd/mm] | [dd/mm, name] |
| [2026-04] | [dd/mm/yyyy hh:mm] | [HR staff] | [CV screening tool] | [noticed almost all applicants over 50 scored as "reject"] | [applicants since dd/mm] | [C] | [suspended tool; manual screening restarted; affected files re-checked] | [dd/mm] | [dd/mm, ref.] | [as needed] | [open] |
Monthly check: rows this month: [n] · level C or D: [n] · all replies sent: [yes / no] · open rows older than 30 days: [n] · tools to review or replace: [list] · next review: [date]
Give every row a number and never delete a row; mark it closed instead. Store screenshots, emails and the AI tool's own logs next to the row. For high-risk systems, Article 26(6) asks deployers to keep the logs the system generates, to the extent they control them, for at least six months unless other law says otherwise, so do not let the tool's logs expire while a row is still open.
Ready-to-use reply wording
| Situation | Short reply |
|---|---|
| Level A or B complaint | "Thank you for telling us. Our AI assistant gave you wrong information about [topic]. The correct position is [answer]. We have corrected the assistant and logged your report (ref. [no.])." |
| "Was that a bot?" | "Yes, that chat was with an AI assistant. You can reach a person at [email / phone / hours]. We have made the notice clearer at the start of the chat." |
| Explanation request (Article 86) | "A [tool type] helped us with [step]. The decision was made by [role] on [date]. The main elements were [criteria]. A person has reviewed your file again on [date]. You can ask further questions at [contact]." |
| Telling the provider (level C or D) | "We are a deployer of [system, version]. On [date] we observed [facts]. We have suspended use from [date]. Please confirm receipt, tell us whether you will report this to the market surveillance authority, and send the reference." |
Checklist
- Every AI tool you use is listed in your AI inventory, so a log row can name it exactly (SME AI inventory template)
- One named owner for the log, and staff know where to report an AI mistake (part of your staff AI use policy)
- Customers have a way to reach a person and to complain; the chatbot says it is AI
- For each high-risk tool: the provider's contact for incidents, and your market surveillance authority, written down in advance (AI vendor questions)
- Human oversight and system logs kept for high-risk tools (oversight log · record-keeping guide)
- Personal data in a complaint handled under your data-protection rules; a data breach may also need its own GDPR notification
This log is a starting point, not a legal opinion or proof of compliance. Other reporting duties (data protection, product safety, sector rules) can apply to the same event, with their own deadlines. Dates and duties above were checked against the AI Act text, the Commission's AI Act Service Desk and the Digital Omnibus on 20 October 2026; check the official source before acting on a real incident. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients rarely think of AI mistakes as something to record. At your next review, ask "has a customer, employee or applicant complained about an AI tool you use this year, and where did you write it down?", note the answer with a date, and hand them this log. It fits next to the client AI inventory workshop. Stay inside your professional rules and pass legal questions to a lawyer.
Keep the record with your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool, then store the date of each monthly log review (or a closed level C or D row) as an evidence record against that tool.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list the AI tools your customers and staff touch in the EURO AI Register free edition, then add this month's incident log review date. Related: Article 50 chatbot checklist · Human oversight log · Annex III high-risk check.
Sources
- Regulation (EU) 2024/1689 (AI Act): Articles 3(49), 26(5), 26(6), 73(2) to 73(5), 85 and 86
- European Commission AI Act Service Desk: Article 73 (consolidated text as at 27 July 2026)
- European Commission AI Act Service Desk: FAQ (enforcement from 2 August 2026; Annex III high-risk rules from 2 December 2027)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), published 24 July 2026
- European Commission: draft guidance and reporting template on serious AI incidents (26 September 2025)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.