How to Prepare Your Company for AI-Related Incidents: The 6-Element Plan and the 5 Types of Incidents
By Pedro Sonda, dooop
To prepare your company for AI incidents, develop a plan with six elements: (1) definition of what constitutes an AI incident and a severity scale; (2) an accessible, non-punitive reporting channel; (3) roles and a response committee; (4) scripts by incident type; (5) internal communication rules with affected parties and authorities, including legal obligations; and (6) periodic simulations. The scripts should cover five types of incidents: errors impacting people or customers, data leaks, system manipulation, biases and discrimination, and supplier failure. Whenever possible, integrate this plan with your company’s existing security incident plan.
Updated October 2026.
This content does not replace legal or information security advice.
What Is an AI Incident
The OECD defines an AI incident as an event in which the development, use, or malfunction of AI systems directly or indirectly causes actual harm; when harm is only plausible, it is considered a risk (hazard) (OECD). This distinction helps companies also record near-incidents, which provide learning opportunities without causing harm.
Why Prepare
| Fact | Source |
|---|---|
| 13% of organizations reported breaches of AI models or applications, and 8% were unsure if they had been compromised; among AI-related security incidents, 60% resulted in compromised data and 31% in operational disruption | IBM, 2025 |
| Air Canada was held liable for misinformation provided by its website chatbot | ABA Business Law Today, 2024 |
| Samsung employees sent sensitive code to ChatGPT, leading the company to restrict generative AI use | CNBC, 2023 |
| The LGPD requires controllers to notify the ANPD and data subjects of security incidents that may cause relevant risk or harm (art. 48) | LGPD |
Interpretation: AI incidents already occur in companies of all sizes, and some carry legal notification obligations. Identifying decision-makers and actions during an incident is costly.
dooop Framework: The 6 Elements of the Plan
| Element | What to Define |
|---|---|
| 1. Definition and Severity | What counts as an incident and near-incident; severity scale (e.g., low, medium, high, critical) with examples |
| 2. Reporting Channel | How anyone can report; guarantee of no punishment for good-faith reports |
| 3. Roles and Committee | Who coordinates; who can suspend systems; who decides communication; contacts outside business hours |
| 4. Scripts by Type | Steps for containment, investigation, and correction for each of the 5 types |
| 5. Communication | Messages for teams, affected parties, customers, authorities, and press; legal deadlines |
| 6. Simulations and Learning | At least annual exercises; plan review after each relevant incident |
dooop Framework: The 5 Types of Incidents
| Type | Generic Example | Initial Actions |
|---|---|---|
| 1. Error with Impact | Assistant provides incorrect condition information to customers | Suspend or activate full review; identify affected parties; correct; see What to Do When AI Makes a Wrong Decision |
| 2. Data Leak | Customer data entered into an unapproved tool; assistant exposes restricted documents | Contain; assess exposed data; evaluate notification to ANPD and data subjects; see How to Handle Confidential Data in AI Tools |
| 3. Manipulation | Malicious content causes an agent to perform an improper action | Stop the agent; reverse actions; review limits; see How to Set Limits for AI Agents |
| 4. Bias and Discrimination | Systematically worse results for a group | Suspend affected use; analyze; review decisions made |
| 5. Supplier Failure | Model change alters behavior; unavailability | Activate alternative process; contact supplier; see How to Govern AI Suppliers |
How to Conduct a Simulation
- Choose a realistic scenario (e.g., a customer service assistant providing incorrect deadlines to hundreds of customers).
- Gather the committee and conduct a real-time discussion: who is notified, who decides to suspend, what is communicated.
- Record gaps: outdated contacts, decisions without owners, missing messages.
- Update the plan within 30 days.
What to Do Now
- Define the severity scale with examples from your company’s AI uses.
- Appoint who can suspend each system with moderate or high risk.
- Schedule the first simulation with the response committee.
To structure AI incident preparedness, explore dooop’s AI Governance practice.
Frequently Asked Questions
Do we need a separate plan for AI? Not necessarily. Many companies incorporate AI incident types into their existing security and privacy incident plans, adding specific scripts.
Should every AI error be recorded as an incident? Minor errors corrected during review are part of quality metrics. Errors affecting customers, people, data, or money should be recorded as incidents. Near-incidents also deserve recording.
How to encourage reporting? By ensuring good-faith reports are not punished, responding quickly, and showing what changed after each report.
Also Read
About dooop
dooop is a consultancy based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.