Tabletop Exercises Aren't Just for Big Companies

A tabletop exercise is a practice incident. You gather the team for an hour, describe a fictional AI failure, and talk through what everyone would do. No systems harmed. No customers affected. Just thinking, out loud, before it counts.

Try this scenario: "Our AI tool just sent 200 customers emails with another customer's account details. It's 3 p.m. Go." Then watch what happens. Who speaks first? Does anyone know how to pause the tool? Who calls the vendor? Who drafts the customer notice? You'll discover your plan's gaps in twenty minutes — gaps that would have taken a real incident to reveal.

Big companies run these with facilitators and slide decks. You don't need any of that. You need a conference room, an hour, one realistic scenario, and the discipline to write down what you learn. Run one twice a year. Rotate the scenario: a data exposure, a biased output gone public, a vendor outage mid-campaign.

Don't automate chaos — and don't wait for real chaos to practice. An hour of pretending is the cheapest incident response investment you'll ever make.

I explain frameworks; I don't give legal counsel.