Module 9: Incident Response & Reporting - DRAFT
What Counts as an AI Incident
Section titled “What Counts as an AI Incident”Examples:
- Client or personal data entered into an unapproved AI tool.
- AI output with serious errors sent to a client.
- AI behavior that suggests compromise (odd requests, unexpected actions).
- AI agent performing actions it was not clearly authorized to perform.
Immediate Response Steps
Section titled “Immediate Response Steps”- Stop using the affected tool/session.
- Preserve logs, prompts, and outputs.
- Notify:
- Project Lead (or project lead)
- security@rbaconsulting.com
- Complete the internal AI incident report.
Severity Levels (Internal)
Section titled “Severity Levels (Internal)”- Critical – Potential or confirmed exposure of PII/PHI/financial systems, or major client impact.
- High – Confidential client data in unapproved tools, unauthorized AI actions with limited scope.
- Medium – Issue caught before client impact, suspicious behavior without confirmed exposure.
- Low – Policy near‑miss, training moment.
Higher severity = faster escalation and broader involvement.
Post-Incident
Section titled “Post-Incident”- Conduct root cause analysis.
- Update processes or configurations to prevent recurrence.
- Share lessons learned with relevant teams.