IT incident report prompt: a clear timeline from your incident log
Updated · By Robert Breen
To write an IT incident report with ChatGPT, paste the prompt below with your incident log: times, steps taken and what was affected, with no client names or data. You get a factual report with a timeline, the systems and data involved, containment steps, what is still unknown and follow-up items. An outage, a lost laptop or client data pasted into the wrong tool all need one clear record afterward, written while people still remember.
This is drafting help only. Whether to tell clients, a regulator or an insurer depends on your contracts, industry and state, and the owner decides that with your advisors. The AI incident response lesson walks through a full one-hour response. For a workplace injury, use the incident report prompt instead.
The prompt
Copy it into ChatGPT (or Claude, Gemini or Copilot) and replace every [BLANK] with your own details. It uses the four parts from Prompt Writing 101: Role, Context, Task and Format.
Role: You are helping the [YOUR ROLE] at [BUSINESS] write an internal IT incident report. You organize facts; you do not decide whether anything must be reported outside the business. Context: What happened, in one line: [INCIDENT SUMMARY]. Below is our incident log. Use only these facts, include no client names or personal data, and write "Not recorded" for any missing time or step. Task: Write the report: summary, timeline (time and action, one per line), systems and kinds of data involved, containment steps taken, what is still unknown, and follow-up items each with an owner or "Owner to be decided". Then list who may need to decide on outside notice, as roles, not as a recommendation. Format: Headed sections in that order. Short past-tense sentences. Under 350 words. No guesses about how much data was seen or copied. Incident log: [INCIDENT LOG]
Fill in the blanks
[YOUR ROLE]- Who writes the report, such as "office manager" or "IT lead."
[BUSINESS]- Your business name and what it does.
[INCIDENT SUMMARY]- One line: what happened and when, with no client names.
[INCIDENT LOG]- Times and steps as you recorded them. Describe the data by type, such as "names and pay rates," never paste the data itself.
Example, filled in
A made-up example from the free lesson Someone Pasted Client Data into AI: Contain It in One Hour using ChatGPT. Harbor and Pine Bookkeeping is the made-up firm in the AI incident response lesson. Jordan, a new hire, pasted a client payroll export into his personal ChatGPT account, and Priya, the office manager, contained it within the hour. Here she writes the internal report. The log is a shortened illustration of the lesson's steps.
Role: You are helping the office manager at Harbor and Pine Bookkeeping, a small bookkeeping firm, write an internal IT incident report. You organize facts; you do not decide whether anything must be reported outside the business. Context: What happened, in one line: a new hire pasted a client payroll export into his personal ChatGPT account at 10:05. Below is our incident log. Use only these facts, include no client names or personal data, and write "Not recorded" for any missing time or step. Task: Write the report: summary, timeline (time and action, one per line), systems and kinds of data involved, containment steps taken, what is still unknown, and follow-up items each with an owner or "Owner to be decided". Then list who may need to decide on outside notice, as roles, not as a recommendation. Format: Headed sections in that order. Short past-tense sentences. Under 350 words. No guesses about how much data was seen or copied. Incident log: 10:05 Payroll export pasted into personal ChatGPT (names, pay rates, Social Security numbers). Stopped further pasting, recorded account and time. Deleted the chat. Found and deleted a saved memory about the client. Checked shared links. Turned off model training on the account. Client email drafted, not yet sent. Policy rule drafted for the team.
What a good answer looks like
- A timeline that starts at 10:05 and lists each containment step in order, with "Not recorded" where the log has no time.
- Data described by type only: names, pay rates and Social Security numbers. No client name anywhere.
- The saved memory listed as a separate finding, since deleting the chat did not remove it.
How to check it before you use it
An AI draft can sound right and still say something you never told it. Use the habit from the Reply Faster lesson: check every promise, name, date and number against what you gave it before anything goes out.
- Search the draft for any client name or number. If one slipped in, remove it before saving.
- Compare every time in the timeline with your log, line by line.
- Make sure follow-up items have real owners, or stay marked "Owner to be decided."
- Take the outside-notice list to the owner and your advisors. The AI does not know your contracts.
Practice it in the free lesson
Someone Pasted Client Data into AI: Contain It in One Hour using ChatGPT: A new hire pasted a client payroll export into ChatGPT. Delete the chat, delete the memory it left behind, turn off training, then write the incident note, the client email and a new policy rule. You do every step yourself in a practice copy of ChatGPT, and nothing touches your real accounts.
Also useful: ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes · Clear Client Data Out of ChatGPT Before It Becomes a Problem: Delete Chats, Clear Memory and Use Temporary Chat
Terms used here
Related prompts
- Incident report prompt: Copy this ChatGPT incident report prompt: paste your notes and witness statements, get a factual draft that flags gaps and…
- Incident report email prompt: A ChatGPT prompt for an incident report email: a short note that sends the report to your manager, plus a neutral team update…
- Incident follow-up action plan prompt: Turn an incident report into a short action plan with owners and due dates. A ChatGPT prompt that suggests options and leaves…
- IT and maintenance request reply prompt: Update a coworker on their IT or maintenance request: where it stands, a workaround, when they'll hear next, and no fix time…
More sops and operations prompts
- Knowledge base article from a ticket prompt: Turn a solved support or IT ticket into a short help article: symptoms, cause, steps to fix it and when to ask for help, so the…
- Lovable web form prompt: Write a Lovable prompt for a web form that posts to n8n: fields, validation, button states, a thank-you message, and a webhook…
- Maintenance request triage prompt: Sort a pile of maintenance and IT requests by priority and team, with the words that drove each call quoted and vague requests…
Frequently asked questions
- How do I write an IT incident report?
- Start from your log: a one-line summary, a timeline with times, what systems and kinds of data were involved, what you did to contain it, what is still unknown and the follow-up items with owners. Keep it factual and leave out guesses.
- Can I use ChatGPT for an IT incident report safely?
- Yes, if you describe data by type and never paste the data itself, client names or account numbers. Use an approved business account, and check the draft for any detail that slipped in.
- What is the difference between an IT incident report and a workplace incident report?
- An IT incident report covers systems and data: outages, lost devices, data in the wrong place. A workplace incident report covers people and property, such as an injury or damaged stock.