Severity Levels for AI Incidents, in Plain English

Not every AI incident deserves the same response. Severity levels keep a mislabeled email from getting the same treatment as a data breach. Here's the plain-English version.

Critical: the tool exposed sensitive data, caused significant financial harm, or made decisions affecting people's rights — hiring, lending, benefits. All hands on deck, leadership notified immediately, tool paused until understood.

High: the tool produced harmful or discriminatory outputs at scale, or a key safeguard failed. Urgent response, same day, with a written assessment within 48 hours.

Medium: the tool made meaningful errors in a limited scope — wrong answers to a handful of customers, a misfiring automation caught quickly. Standard response: fix, document, review within two weeks.

Low: cosmetic issues, one-off odd outputs with no impact, near-misses caught by existing review. Log it, fix it in the normal workflow.

The point of levels isn't bureaucracy. It's proportionality — and speed. When everyone agrees in advance what "critical" means, nobody wastes the first hour debating whether this is a big deal. Define them now, while it's quiet.

I explain frameworks; I don't give legal counsel.