AI Incident Response Procedures

Objective

Maintain a tested AI-specific incident response capability that detects, triages, contains, and recovers from AI incidents (prompt injection, model misbehavior, data exfiltration, decision errors with material impact), with regulator notification per applicable rules.

Applicability

AI types

LLM, Agentic AI, Traditional ML, Computer Vision, Generative AI, Multi-modal

Deployment models

SaaS, Self-hosted, Hybrid, Edge

Lifecycle stages

Operation & Monitoring

Risk domains

Governance, Model, Data

Regulatory regimes

EU AI Act, ISO 42001, Banking, Healthcare

Company size

MidMarket, Enterprise

Rationale

AI incidents differ from traditional cyber incidents: they often originate from model behavior rather than infrastructure compromise; they may be subtle (slow drift, biased outputs) rather than immediate; and they require AI-domain expertise to triage. EU AI Act Article 73 requires reporting of serious incidents for high-risk systems. Generic IR runbooks miss AI-specific containment options (rollback model version, disable tool, lower autonomy) and AI-specific stakeholders (AI Governance, Model Owner).

Control narrative

The organization maintains AI-specific runbooks integrated with the broader Cyber Incident Response Plan. Runbooks cover at minimum: confirmed prompt injection with material impact, model misbehavior (bias, hallucination producing harm), training/inference data exfiltration, agentic misuse, vendor AI incident affecting the org, and decision errors with regulatory impact. Each runbook specifies trigger criteria, response phases (immediate / short-term / long-term), RACI, AI-specific containment options, evidence preservation requirements, stakeholder communications (including regulator notification timelines), and post-incident review obligations. Runbooks are tested at minimum annually via tabletop exercise. AI incidents are tracked in the central incident system with AI-specific tags.

Test of Design

Procedures

1. Obtain the AI Incident Response standard and confirm scope and integration with the cyber IR plan.
2. Confirm runbooks exist for the minimum incident types listed in the control narrative.
3. Confirm regulator notification timelines and decision-making authority are documented (e.g., EU AI Act Article 73; sectoral rules).
4. Confirm annual tabletop requirement and post-incident review requirement.
5. Confirm AI-specific tagging in the central incident system.

Inquiries

• Who is on the AI Incident Response standing team?
• How is the decision made to invoke an AI runbook vs. the generic cyber runbook?
• How are vendor AI incidents tracked and acted upon?
• How is communication coordinated for incidents with public/customer impact?

Inspections

• AI Incident Response standard.
• Runbook inventory.
• Tabletop exercise reports for the audit period.
• Sample of incident records from the audit period (if any).
• Post-incident review documentation.

Test of Operating Effectiveness

Procedures

1. For the audit period, obtain the population of AI-tagged incidents.
2. For a sample, confirm the appropriate runbook was invoked and steps documented per the runbook structure.
3. Confirm regulator-notification timelines were met for incidents meeting reporting criteria.
4. Inspect post-incident review documentation and confirm root cause, lessons learned, and remediation owners are recorded.
5. Confirm annual tabletop occurred with documented scenario, participants, and findings.
6. For tabletop findings, trace to closure of action items.

Sample-size guidance

Evidence requirements

Required

• AI Incident Response standard PDF/Word · At fieldwork
• Runbook inventory and sampled runbooks PDF/Word · At fieldwork
• Tabletop exercise report for audit period PDF/Word · Annual
• Incident records for sampled events System export · Per sample

Supporting

• Regulator notification records PDF/email · Per applicable event
• Post-incident review documents PDF/Word · Per applicable event

Retention: 10 years for regulated environments; 7 years otherwise

Framework mappings

Related controls

• AI-CTRL-003

  Adversarial Robustness Testing for LLM Systems

• AI-CTRL-008

  AI System Logging and Monitoring

References

• EU AI Act Article 73 — Reporting of serious incidents
• NIST AI RMF — MANAGE function
• ISO/IEC 42001:2023, clause 10