What is AI incident response?
Quick answer
AI incident response is the plan a company follows when AI use goes wrong: someone pastes confidential data into an AI tool, an AI draft with a false promise reaches a client, or an agent takes an action nobody approved. It says who to tell, what to record, how to contain it and how to stop it happening again.
Last updated
Take the free module →Module 3 of the free AI at Work: Start Here course, about 10 minutes. No account needed.
Updated · By Robert Breen
Why it matters for a small business
Mistakes with AI are not a question of if. A busy person will paste a file they should not have, or send a draft they did not read closely. What decides the damage is the next hour. If the person is afraid of blame, they quietly delete the chat and say nothing, and you find out weeks later from a client. If they know the plan and know they will not be blamed, you hear about it the same day while there is still something to fix.
A small office does not need a long playbook. It needs five steps everyone knows, a named owner, and a line in the AI policy that says mistakes are reported the same day with no blame. That same-day rule is the piece most policies leave out.
A five-step plan for a small office
| Step | What happens |
|---|---|
| 1. Stop and tell | The person tells the policy owner the same day, before deleting anything |
| 2. Record | Which tool and account, what was pasted, when, any shared link |
| 3. Contain | Delete the chat and shared link, check training and memory settings |
| 4. Decide who else to tell | Check the client contract and ask a qualified adviser if personal data was involved |
| 5. Fix the cause | Update the cheat sheet, tools list or policy |
This is practical guidance, not legal advice. Notification duties depend on your contracts and local law.
In a real lesson: ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes
In the ChatGPT data controls lesson, Priya runs the office at Hartwell Bookkeeping, a made-up six-person firm. A note tells her that last Tuesday a new bookkeeper pasted a client payroll export into ChatGPT on her personal login "to tidy the columns." Nobody had told her not to, and nobody knows which settings that account has.
That is an AI incident. The lesson's answer is the containment and prevention half of the plan: training off, memory off on shared logins, a monthly shared-links check, export before delete, and a one-page policy that names Priya as the person to tell, the same day, with no blame for reporting.
Try this lesson free or read the step-by-step guide.
Common confusions
AI incident response vs a general data breach plan
A breach plan covers any data loss. AI incident response adds the AI-specific steps: which AI account, the chat and shared links, training and memory settings, and any agent or automation involved.
Incident response vs deleting the chat
Deleting the chat is one containment step, not the plan. Record what happened first, so you can decide whether anyone else needs to know.
Tips
- Write the five steps on the same page as the policy, not in a separate binder.
- Say "no blame for reporting" out loud when you roll the policy out.
Related terms
More Business terms
Where you use it: free lessons
- ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes (ChatGPT, 10 min)
- Use AI at Work Without Leaking Client Data using ChatGPT (ChatGPT, 7 min)
- Roll Out a Team AI Policy in One Afternoon using Claude (Claude, 10 min)
Frequently asked questions
- What should I do if I pasted client data into ChatGPT?
- Tell the person who owns your AI policy the same day and write down what you pasted, where and when. Then delete the chat and any shared link, and check the account's training and memory settings. Your company decides whether the client or anyone else must be told.
- Does deleting a chat remove the data?
- It removes it from your history. Vendors may keep copies for a time, so check your provider's data policy and record the incident first.
- Who should handle AI incidents in a small company?
- The same named person who owns the AI policy. They collect the facts, contain the problem and decide, with a qualified adviser when needed, whether anyone else must be told.