AI incident response checklist

In the first hour

1. 1
   Contain it. Pause the system or the affected feature if harm is ongoing. Use your kill switch.
2. 2
   Log it in V77 Trust with the time you became aware. That time starts every legal clock.
3. 3
   Tick the rules that may apply (EU AI Act serious incident, DORA, GDPR) and read the deadlines shown.
4. 4
   Tell the right people: the system owner, compliance, security, data protection officer, and legal.

Within the first day

1. 1
   Preserve evidence: logs, inputs and outputs, model and prompt versions, screenshots. Don't change the system before you've saved them.
2. 2
   Assess the impact: who was affected, how, and how many.
3. 3
   Decide on reporting. If it's a serious incident, a major ICT incident or a personal data breach, prepare the report now. Short deadlines (2 days, 4 or 24 hours, 72 hours) leave no room.
4. 4
   If you're a deployer, tell the provider straight away.

Within the reporting deadline

1. 1
   Submit the reports and choose Mark submitted on each deadline.
2. 2
   Tell affected people where required.

Afterwards

1. 1
   Find the root cause: data, model, prompt, integration, human process.
2. 2
   Record corrective actions and track them as findings with owners and dates.
3. 3
   Close the incident once the root cause is recorded.
4. 4
   Update the risk assessment, tests and oversight procedure so it can't happen the same way again.