When AI Gets It Wrong: A Simple Incident-Response Plan

Every organisation using AI will eventually see a bad output, a data mix-up or a customer complaint. A little preparation makes these moments manageable.

• Wrong information sent to customers or published.
• Sensitive data pasted into the wrong tool.
• Biased or offensive output.
• An agent taking an unintended action such as sending, deleting or buying.
• Prompt injection causing unexpected behaviour.
• Vendor outages or silent model changes.

1. Name an owner for AI risk and incidents.
2. List approved tools and permitted data.
3. Set approval steps for customer-facing or irreversible actions.
4. Keep logs of what AI systems did.
5. Write a one-page plan and share it.

1. Stop the harm: pause the tool, disable the automation or revoke access.
2. Contain: identify what was affected, who saw it and what data was involved.
3. Preserve evidence: screenshots, logs and prompts.
4. Assess: is it a data breach, a safety issue, a legal issue or a customer problem?
5. Notify people and authorities where legally required, within the deadlines that apply.
6. Correct: fix the output, update customers and apologise plainly.

• Find the root cause: unclear prompt, missing check, over-broad permission or a tool limitation.
• Add controls: approvals, test cases, restricted access or a different tool.
• Share lessons without blame.
• Update training and policies.
• Test again before returning to normal.

Be honest, specific and timely. Say what happened, who is affected, what you're doing and how to get help.

You can't prevent every error, but you can be ready. Clear ownership, logs and approval steps turn a crisis into a learning moment.