Incident response for AI

How teams respond when AI features leak data, cause harm, or get abused—playbooks, severity, comms, and fixes.

Minutes matter. AI incidents look like security incidents plus model/prompt specifics.

Detect → contain (disable tools/features) → eradicate (patch prompts/filters/ACLs) → recover → lessons learned → update safety suites. Cross-link Course 29 what-to-do for users.

Draft a one-page IR card: owner, severity table, kill switch location.

⚠️ Myth: “The model did it” ends responsibility.

✓ Reality: Deployers own the system.

• Course 29 what-to-do; Course 17 rollback; NIST AI RMF
• https://www.nist.gov/itl/ai-risk-management-framework ↗