# AI incident response runbook — template

> AI incidents rarely look like security incidents. The system usually stays up and keeps
> producing confident, wrong or harmful output. Your existing IR plan probably has no
> trigger for that — this fills the gap and plugs into it.

**Owner:** · **Version:** · **Last tested:**

---

## 1. What counts as an AI incident

Any of the following, whether or not personal data is involved:

- Output that is discriminatory, harmful, defamatory or unsafe
- Material accuracy degradation, drift, or performance collapse on a subgroup
- The system operating outside its documented intended use
- Training-data leakage, model inversion, membership inference, or extraction
- Prompt injection or jailbreak achieving unintended action
- Data poisoning affecting training or fine-tuning
- Automated decisions made without the required human review
- Unavailability of a system a business process depends on
- Third-party model change that materially alters behaviour

> **Serious incidents** involving high-risk systems may carry a reporting duty to authorities
> under EU AI Act Art. 73. Where personal data is breached, GDPR Arts. 33–34 apply and the
> 72-hour clock to the supervisory authority runs from *awareness*. Confirm current thresholds
> and deadlines with legal — do not rely on this template for the notification decision.

## 2. Severity

| Level | Definition | Response |
|---|---|---|
| **SEV1** | Harm occurring to people; unlawful processing; regulatory exposure | Immediate; exec notified; consider suspension |
| **SEV2** | Materially wrong output in a consequential process; no confirmed harm yet | Same business day |
| **SEV3** | Degradation without individual impact | Next business day |
| **SEV4** | Cosmetic or near-miss | Log and review at next cycle |

## 3. Response flow

**Detect** — sources: monitoring alert, human reviewer, user complaint, vendor notice,
red-team finding, media/regulator contact.

**Triage (within [30 min] for SEV1/2)**
- Which system, which version, since when?
- Who is affected, and how many?
- Is it still producing output? *Default to containment — a wrong answer at scale is worse than no answer.*

**Contain**
- Options in escalating order: raise the review threshold → route all output to human review → disable the feature → roll back to the previous model version → take the system offline.
- Record who authorised containment and when.

**Assess**
- Root cause: data, model, prompt, integration, or misuse?
- Blast radius: which decisions were affected, over what period?
- Are any of those decisions reversible?

**Notify**
- Internal: system owner, DPO/privacy, legal, security, comms.
- External: assess GDPR Arts. 33–34; AI Act Art. 73 serious-incident reporting; contractual notification to customers; vendor.
- Decision and reasoning must be documented even where you decide *not* to notify.

**Remediate**
- Fix, retrain or roll back.
- **Identify affected individuals and put the decision right** — the step most plans forget.
- Re-test before restoring, including the specific failure case.

**Review**
- Blameless post-incident review within [5 working days].
- Update the impact assessment, model card and inventory entry.
- Add a monitoring rule or test that would have caught this earlier.

## 4. Roles

| Role | Name | Contact | Backup |
|---|---|---|---|
| Incident lead | | | |
| System owner | | | |
| DPO / privacy | | | |
| Security | | | |
| Legal / regulatory | | | |
| Communications | | | |
| Executive sponsor | | | |

## 5. Incident log

| Field | Value |
|---|---|
| Incident ID | |
| Detected (date/time, by whom) | |
| System and model version | |
| Severity | |
| Description | |
| Individuals affected (number, groups) | |
| Containment taken and time | |
| Root cause | |
| Notification decisions and reasoning | |
| Remediation | |
| Affected decisions corrected? | |
| Closed (date) | |
| Actions arising | |

## 6. Keep it honest

Test this runbook at least annually with a tabletop exercise. A plausible scenario: your vendor
silently ships a model update, subgroup accuracy drops 15%, and nobody notices for three weeks
because monitoring only tracked aggregate accuracy.