AI Incident Response, Step by Step

When an AI incident happens, don't improvise. Run the steps, in order, every time.

Step one: detect and record. Note exactly what happened, when, and how you found out. Screenshots, outputs, timestamps. Memory fades; the log doesn't.

Step two: contain. Stop the bleeding first. Pause the tool, disconnect the integration, pull the bad output offline — whatever limits further harm. You can investigate a paused tool. You can't un-send what it already did.

Step three: assess scope. Who was affected? What data was involved? Was this one bad output or a pattern? This is where you find out whether you have an incident or a crisis.

Step four: notify. Tell leadership, tell the vendor, and tell affected people in the order your plan specifies. Say what you know, say what you don't, and say when you'll update them.

Step five: learn. Within two weeks, write down the root cause and the fix, and assign the fix to a person with a deadline. An incident you don't learn from is just a preview.

The NIST AI Risk Management Framework calls this the Manage function — responding to risk as it materializes. The vocabulary is new. The discipline is ancient: stop it, scope it, tell people, fix it.

I explain frameworks; I don't give legal counsel.