Version 2025-09-22 By Spencer Brawner

AI Incident Response: The First Hour

Incident response AI security Emergency procedures Evidence preservation Containment

TL;DR

When AI behavior causes harm or near-miss, treat it as an incident. Stabilize the system, preserve evidence, classify severity, notify stakeholders, and start corrective actions. Capture prompts, retrieved context, model/version, tool calls, approvals, and logs. Align with your AIMS and security IR processes.

Published September 22, 2025

Section 01 // Key Facts

Key Facts

5 facts documented

Incidents include security, safety, compliance, or ethical harms tied to AI outputs.
[2]
The first hour prioritizes containment and evidence capture.
[1]
Logging must include prompts, context, outputs, tool calls, and approvals.
[1]
Reporting and CAPA are required under governance processes.
[1]
Post-incident reviews update controls and training.
[1]

Section 02 // Implementation

Implementation Steps

10 steps

01
Declare & page on-call → ticket.
02
Contain (disable features/tool calls) → change record.
03
Preserve prompts/context/logs → forensics bundle.
04
Classify severity & impact → SEV doc.
05
Notify stakeholders → comms record.
06
Triage root causes/hypotheses → triage notes.
07
Countermeasures (filters, gates) → hotfix record.
08
Monitor reoccurrence → metrics.
09
Document timeline → IR log.
10
CAPA & schedule review → actions, owners.

Section 03 // Glossary

Glossary

6 terms

Incident

Event causing or potentially causing harm to stakeholders or systems

Containment

Actions to prevent further harm or damage from an incident

Forensics bundle

Collection of evidence for incident investigation

Severity

Assessment of incident impact and urgency

CAPA

Corrective and Preventive Actions - systematic response to incidents

Post-incident review

Analysis of incident response to improve future handling

Section 04 // References

References

2 sources

[1]
ISO 42001 AI Management Systems Standard https://www.iso.org/standard/78380.html
[2]
NIST AI Risk Management Framework https://www.nist.gov/itl/ai-risk-management-framework

Section 05 // Facts

Machine-Readable Facts

3 claims

[
  {
    "id": "f-incident",
    "claim": "AI incidents include harms tied to AI outputs across security, safety, and compliance.",
    "source": "https://www.nist.gov/itl/ai-risk-management-framework"
  },
  {
    "id": "f-evidence",
    "claim": "First-hour actions prioritize containment and evidence capture.",
    "source": "https://www.iso.org/standard/78380.html"
  },
  {
    "id": "f-capa",
    "claim": "Governance requires corrective and preventive actions with owners and deadlines.",
    "source": "https://www.iso.org/standard/78380.html"
  }
]