What should be preserved straight away?
- The model version and configuration in use at the time, and the vendor’s update history.
- The input data the model received, including sensor values and their quality flags.
- The outputs it produced, and what the operator’s display showed.
- System logs, alarms and operator actions over the same period.
- The MOC and acceptance records for the system.
Havtil’s May 2025 letter (published 2 June 2025) already expects technical documentation of AI systems to be available to the authorities (Havtil). Under Article 26 of the AI Act, deployers of high-risk systems must keep automatically generated logs for at least six months. They must also report a serious incident to the provider and then the market surveillance authority, from the dates on this checklist.
How does the investigation treat the AI?
As equipment, the questions are whether the model worked inside its valid range, whether its inputs were sound, and whether the last change to it went through management of change.
As information, the questions are what the operator saw, what they believed about the model’s reliability, and whether they could run the plant without it. An investigation that stops at “the AI was wrong” misses the barriers that let a wrong output through. The cases show the pattern. In Linmara, a soft sensor tested only on normal data reports sweet gas during an H₂S breakthrough. In Corlinda, a model performs as designed and a deferral it supported still ends in failure.
How is operator trust restored?
By showing operators what the investigation found about the model and what changed as a result. Retraining, new limits or a changed role for the AI each go through MOC and training before restart. See operator competence.
I led incident investigations at an upper-tier Seveso plant. If AI is in the chain of your event, contact me.