Prepare an AI Incident Response Plan Before You Need One

AI incidents can involve exposed data, harmful output, unauthorized action, silent quality decline, misleading claims, or vendor failure. Ordinary IT response may not cover the business and human consequences. This decision connects to Build an AI Strategy That Starts With Business Value and Turn Company Priorities Into an AI Opportunity Portfolio, which provide the strategic direction and portfolio context. Use this four-part leadership framework Define scenarios — List material failures, affected groups, signals, and severity. Assign authority — Name who can pause, disconnect, communicate, investigate, and restore. Preserve evidence — Retain inputs, outputs, model and workflow versions, logs, approvals, and changes lawfully. Recover and learn — Use safe fallback, validate fixes, notify appropriately, and update tests and controls. A practical decision example A customer assistant begins citing an outdated refund policy after a source update. Monitoring detects the shift; the owner pauses automated replies, returns to manual handling, preserves examples, corrects the source process, and retests before restoration. This is a hypothetical example; use your own baseline, constraints, and evidence. Evidence, governance, and responsible use Use the NIST AI Risk Management Framework to connect the initiative to governance, context, measurement, and ongoing management. The companion NIST AI RMF Playbook turns those functions into questions leaders can assign and review. The GAO AI Accountability Framework is useful for examining governance, data, performance, and monitoring across the system life cycle. Compare the plan with the OECD AI Principles, particularly transparency, robustness, accountability, and respect for people affected by the system. For generative AI, review the NIST Generative AI Profile and test representative cases using OpenAI’s evaluation guidance. Use the OWASP Top 10 for LLM Applications to discuss application threats before a model can access sensitive information or take actions. Check performance statements against the FTC’s guidance on AI claims, and review information handling with the FTC’s privacy and security resources. For a broader organizational management approach, study the ISO/IEC 42001 overview. Take this to the next leadership meeting Run a tabletop exercise with one privacy scenario, one harmful-output scenario, one unauthorized-action scenario, and one vendor outage. Record every unclear decision and missing contact. Record the owner, evidence source, decision date, and what would cause the company to stop. The goal is not to make the document look complete. The goal is to make the next decision explicit, measurable, and accountable. Continue with Why Good AI Tools Fail Inside Real Organizations. Use Run a Quarterly AI Portfolio Review: Keep, Fix, Scale, or Stop to revisit the decision with current evidence.