What to Put in an AI Incident Report

After an AI incident, write the report within 48 hours, while memory is fresh and logs are intact. A good one answers six questions.

What happened? Describe the bad output or behavior precisely. Include the prompt, the output, and a screenshot. Vague reports produce vague fixes.

When was it detected, and by whom? The gap between occurrence and detection is itself valuable data. If a customer found it before you did, that's a finding.

What was the scope? One output or many? Which customers, which data, which time window? Say what you checked, not just what you found.

What did you do? List containment actions with timestamps: tool paused at 2:14, vendor notified at 2:40, customers contacted at 4:00.

What's the root cause, as best you understand it? A model update, a bad configuration, a use case the tool was never designed for. Honest beats flattering.

What changes now? Name the fix, the owner, and the deadline. A report without assigned follow-ups is a story, not a control.

File it where you'll find it. Future you, facing the next incident, will be grateful.

I explain frameworks; I don't give legal counsel.