Triage Process Any detection event triggers a predefined triage process completed within 24 hours. The triage assesses whether the event meets the Article 3(49) definition using a documented decision tree: is there evidence of actual or potential harm to individuals? Does the harm meet the severity criteria? Is the harm attributable to the AI system’s output or behaviour? If the Article 3(49) threshold is met, the triage classifies the severity tier (2-day, 10-day, or 15-day), assigns an incident lead (typically a senior Technical SME), notifies the AI Governance Lead and Legal and Regulatory Advisor immediately, and initiates evidence preservation. If the threshold is not met, the event is logged in the serious incident register as an assessed event with the triage rationale documented. Each triage determination, whether positive or negative, is documented with the evidence considered and the rationale for the conclusion. This documentation protects the organisation if the determination is later questioned. Key outputs

• 24-hour triage completion from detection
• Article 3(49) decision tree applied
• Severity tier classification and incident lead assignment
• Documented determination regardless of outcome