3 min read665 wordsv1.0.2.0Last Updated: 1 Aug 2026 AI Incident Response
NIST AI RMF: MANAGE-4.1–4.3 (Prioritise, Respond, Recover)
EU AI Act: Art. 20 (Corrective actions), Art. 73 (Serious incident reporting)
ISO 42001: A.6.2 (AI incident management)
NIST AI 600-1: §2.1, §2.2, §2.3, §2.8, §2.9, §2.11
MITRE ATLAS: TA0014 (Impact), TA0013 (Exfiltration)
Incident Classification
| Severity |
Criteria |
SLA |
Escalation |
| SEV-1 (Critical) |
Active attack; data exfiltration; safety impact; regulatory reportable (Art. 73) |
15 min acknowledge; 1 hr containment |
Page CISO, Legal, Executive |
| SEV-2 (High) |
Compromise of model/data integrity; high-value asset affected |
30 min acknowledge; 4 hr containment |
Page on-call lead, Legal |
| SEV-3 (Medium) |
Anomaly detected; limited scope; no confirmed exfiltration |
2 hr acknowledge; 24 hr resolution |
On-call lead, Team lead |
| SEV-4 (Low) |
Drift alert; policy violation; minor anomaly |
Next business day |
Team lead |
Response Phases
1. Detection (MANAGE-4.1)
| Source |
Trigger |
Auto-Enrichment |
| Runtime monitoring |
Anomaly alert (drift, perplexity, refusal spike) |
Session context, user, model, recent deployments |
| Red-team / pentest |
Finding report |
CVSS-AI score, ATLAS mapping |
| User / partner report |
Abuse, bias, hallucination report |
User context, session replay |
| Supply chain alert |
CVE in dependency; model hub compromise |
SBOM impact analysis |
| Regulatory notice |
Authority inquiry |
Legal triage |
Automation: SIEM correlation rule → auto-create incident ticket (SEV-1/2) or alert (SEV-3/4) with context.
2. Triage & Containment (MANAGE-4.2)
SEV-1/2 Immediate Actions (within 15 min):
- Isolate — Revoke API keys; disable model endpoint; quarantine session
- Preserve — Snapshot logs, model state, prompt/response pairs, memory dumps
- Notify — Page on-call; Legal if Art. 73 reportable (72 hrs to authority)
- Assess — Determine scope: single session / model / deployment / organisation
Containment Playbooks:
| Incident Type |
Containment Action |
| Prompt injection / jailbreak |
Revoke session; block user/IP; deploy emergency classifier rule |
| Model extraction / distillation |
Rate-limit identity; enable watermarking; rotate API keys |
| Data poisoning (supply chain) |
Quarantine dataset; rollback to last clean checkpoint; re-index |
| Adversarial attack (GCG/PAIR/TAP) |
Block attacking IPs; deploy adversarial detector; rate-limit |
| Model DoS |
Enable strict rate limits; circuit breaker; auto-scale inference |
| Sensitive data disclosure |
Revoke session; trigger DLP purge; notify Privacy Officer |
| Agent hijack / tool misuse |
Disable tool; revoke agent token; audit delegation chain |
| Backdoored model / adapter |
Remove from registry; rollback deployment; scan registry |
3. Eradication (MANAGE-4.2)
| Action |
Owner |
Verification |
| Root cause analysis (5 Whys) |
Incident Lead |
RCA doc in incident ticket |
| Remove attacker artefacts |
ML Platform |
Clean scan of registry, memory, logs |
| Patch / reconfigure |
Engineering |
Deploy fix; canary test; promote |
| Rotate compromised credentials |
Security |
Verify rotation in all consumers |
| Update detection rules |
SecOps |
Rule deployed; test trigger |
4. Recovery (MANAGE-4.3)
| Step |
Criteria |
| Validate clean state |
Golden-set evaluation passes; adversarial test suite clean |
| Gradual re-enable |
Canary (1%) → 10% → 50% → 100% with monitoring |
| Monitor |
Enhanced logging 72 hrs; anomaly baseline re-established |
| Communicate |
Stakeholder update; user notification if data affected |
5. Post-Incident (MANAGE-4.3, ISO 42001 A.6.2)
| Artefact |
Timeline |
Audience |
| Incident Report |
48 hrs |
Internal (Legal, Exec, SecOps, ML Eng) |
| Regulatory Notification (Art. 73) |
72 hrs from awareness |
Market Surveillance Authority |
| Post-Mortem |
5 business days |
All stakeholders; blameless |
| Action Items |
Tracked in backlog |
SLA: Critical 30d, High 60d, Medium 90d |
Post-Mortem Template:
- Timeline (detection → containment → recovery)
- Root cause (technical + process)
- Impact assessment (users, data, model, reputation, regulatory)
- What went well / what didn't
- Action items (detection, containment, eradication, recovery, prevention)
EU AI Act Art. 73 Reporting
| Condition |
Deadline |
Channel |
| Serious incident (death, serious injury, fundamental rights breach, critical infrastructure disruption) |
72 hours |
Market Surveillance Authority of MS where incident occurred |
| Non-compliance with Chapter 2/3/5 |
15 days |
Market Surveillance Authority |
| GPAI systemic risk incident |
72 hours |
AI Office + National Authorities |
Report must include: Description, time, affected systems, root cause, impact, corrective actions, contact details.
Citation Register