An AI incident is more than a system outage. It can be a material performance deterioration, biased outcome, data leak, fabricated explanation, uncontrolled model change, prompt injection, cyber compromise or human-oversight failure. Compliance depends on detecting and evidencing the response.
Define incident classes
Create severity levels based on customer harm, financial impact, regulatory exposure, confidentiality, scale, reversibility and duration. Include near misses. A prompt that exposed confidential data but was blocked can reveal a control weakness before harm occurs.
Monitor leading indicators
Track drift, missingness, confidence, abstention, override, referral, complaint, error, hallucination and data-access indicators. For financial models, monitor calibration and loss performance. For generative tools, sample outputs against trusted sources and record the reviewer.
Make response evidence usable
Keep a timeline of detection, containment, decision, notification, root cause, remediation and validation. Link the incident to the inventory, version, supplier and affected customers. The post-incident review should update controls, training and scenario tests rather than close with a narrative only.
The NIST AI RMF provides a lifecycle structure for monitoring and response. Quantica Risk Modelling recommends testing the playbook through controlled exercises.