ai-incident-response

AI Incident Response

An AI incident is any event where an AI system's behaviour deviates from its intended, safe, and fair operation. Do not minimise, ignore, or quietly fix these. Follow this process every time.

Immediate Triage (First 15 Minutes)

1. Stop and Assess

Before doing anything else, answer these questions:

Is the system currently causing or about to cause active harm?
  YES → Immediately escalate to P1. Skip to EMERGENCY SHUTDOWN.
  NO  → Continue triage.

Is the incident affecting real citizens / users right now?
  YES → Treat as P1 or P2.
  NO  → Continue triage.

Is personal or sensitive data involved?
  YES → ICO notification may be required within 72 hours.
  NO  → Continue triage.

2. Classify the Incident

Type	Examples
Performance degradation	Accuracy drops significantly, response times increase
Fairness violation	Metrics show disproportionate impact on a group
Safety failure	Harmful, dangerous, or illegal output generated
Data incident	Unauthorised access, accidental disclosure, data poisoning
Manipulation	Prompt injection, adversarial attack, model inversion
Compliance failure	GDPR breach, ATRS not updated, override log missing

3. Assign Severity

P1 — Critical: System actively causing harm. Shut down immediately.
P2 — High:     Significant risk of harm. Pause within 4 hours.
P3 — Medium:   Fairness or performance threshold exceeded. Fix within 24 hours.
P4 — Low:      Anomaly detected. Investigate within 72 hours.

---

Emergency Shutdown (P1 Only)

Execute this in order. Do not skip steps.

# Step 1: Stop new requests immediately
# (Replace with your actual shutdown command)
systemctl stop ai-inference-service
# or: kubectl scale deployment ai-service --replicas=0
# or: disable the API gateway route

# Step 2: Verify the system is stopped
curl -f https://your-ai-endpoint/health && echo "STILL RUNNING - escalate" || echo "System stopped"

# Step 3: Preserve all logs — do NOT rotate or delete
cp -r /var/log/ai-service/ /var/log/ai-service-incident-backup-$(date +%Y%m%d%H%M%S)/

# Step 4: Activate manual fallback
# (Document your manual fallback procedure here)
echo "Activating manual fallback process — notify [team lead name]"

# Step 5: Notify emergency contacts immediately
# (Add your actual contacts)