Write Your AI Incident Plan Before You Need It

Somewhere, a chatbot is right now confidently telling a customer something untrue, and nobody at the company knows yet. AI incidents aren't a matter of if. The only question is whether you'll respond from a plan or from panic.

Write the plan while everything is calm. Name the person who gets the first call. Define what counts as an incident — harmful outputs, data exposure, decisions gone wrong. Spell out the first 24 hours: contain it, assess who was affected, decide whether to pause the tool. And write the customer message template now, when you can think clearly.

Then do the unglamorous part: put the plan where people can find it, and walk through it once a year. A plan nobody has read is a hope with formatting.

I explain frameworks; I don't give legal counsel.