# AI incident runbook

## Triggers

- unauthorized or irreversible effect;
- disclosure, unauthorized access, or compliance with a malicious instruction;
- discrimination or severe error;
- loss of logging or identity attribution;
- loop, consumption, or volume beyond limits;
- unevaluated supplier change;
- inability to obtain recourse or return to the manual process.

## 0–15 minutes — Contain

- suspend the affected workflow or tool;
- revoke exposed access or secrets;
- prevent propagation without destroying evidence;
- switch to the manual process;
- name the incident commander.

## 15–60 minutes — Assess

- record timestamps, versions, users, data, tools, and destinations;
- distinguish actions requested, dispatched, confirmed, and persistent;
- identify affected people or systems;
- determine notification duties;
- preserve evidence proportionately.

## Resolve

- correct or reverse effects where possible;
- notify accountable roles and competent authorities according to the plan;
- communicate without speculation;
- test the fix against the incident case and variants;
- obtain a new gate decision before resuming.

## After the incident

- root cause and organizational contributors;
- controls expected, present, and effective;
- updates to tests, risks, training, and supplier controls;
- decision: resume, restrict, replace, or retire;
- owner and deadline for every action.