AI Incident Triage Sheet
When an AI system fails, answer two questions before any investigation. Is data leaving the boundary right now, and if so cut the egress first. Can the system take actions, and if so revoke its credentials before investigating. Containment precedes analysis.
Incident response for AI systems fails when teams begin by diagnosing. An agent with live credentials continues acting while the investigation proceeds, and every minute of analysis is a minute of continued exposure.
The template
When something goes wrong, answer these in order.
- Is data leaving the boundary right now? If yes, cut the egress before anything else.
- Can the system take actions? If yes, revoke its credentials before investigating.
- What is the fallback process, and is it running?
- How many outputs are affected, and can you enumerate the recipients?
- Is the cause input, model, integration, or permission? Investigate in that order, because that is the order of frequency.
- Does this trigger a notification obligation? Start the clock from detection, not from confirmation.
How to use it
- Work the questions in the order given. The order is the artefact; the individual questions are obvious in isolation.
- Cut egress before anything else if data is leaving the boundary, including before establishing what data it is.
- Revoke credentials from any system that can take actions before investigating, because an agent keeps acting during triage.
- Only then establish scope, cause, and notification obligations.
Where this goes wrong
The failure modes below are the ones worth checking for first. Each describes a way this artefact stops doing its job while still appearing to be in use.
- Triage starts only once someone recognises an event as an AI incident. Most of these arrive as a service complaint, a wrong decision, or a data query. The intake route has to be the ordinary one, with AI identified during triage rather than before it.
- Severity is scored on system behaviour instead of consequence to a person. A model degrading quietly while it decides eligibility is more serious than one failing loudly in a reporting dashboard, and severity scales that only measure technical impact invert that.
- Nobody holds the authority to stop the system. A triage process that can escalate but cannot halt produces well-documented harm. The stopping authority must be named in advance and reachable outside working hours.
- Incidents are closed without changing anything upstream. Triage that ends at restoration and never reaches the register, the risk tier, or the approval gate guarantees the same incident returns.
Common questions
What do you do first when an AI system fails?
Contain before you diagnose. First, establish whether data is leaving the boundary right now, and if it is, cut the egress before anything else. Second, establish whether the system can take actions, and if it can, revoke its credentials before investigating. Only then determine scope, cause, and notification obligations. An agent with live credentials keeps acting throughout the investigation.