# An AI incident-response plan in seven steps

- **Published:** 2026-07-23
- **Updated:** 2026-10-12
- **Category:** Security & Governance
- **Author:** Sinthetix
- **URL:** https://sinthetix.com/blog/ai-incident-response-plan-checklist

> A short checklist for adding AI failures, prompt injection and model withdrawal to the incident-response plan you already have.

You probably already have an incident-response plan. It likely assumes servers, accounts and data, not an assistant that leaks a document, a tool-using agent that takes a wrong action, or a model your product depends on being switched off. This checklist adds the AI cases to the plan rather than replacing it.

**Key takeaways**

- NIST's current incident-response guidance treats response as part of overall cybersecurity risk management, so AI incidents can be folded into the same program [1].
- Prompt injection is a residual risk to manage, per the UK NCSC, so logging and limits matter as much as prevention [2].
- Treat loss of a model or vendor as an incident type, with a named fallback.

## The checklist

1. **Inventory every AI system and its permissions.** Know which models, vendors, data sources and tools each assistant or agent can reach. You cannot respond to something you cannot list.
2. **Define what counts as an AI incident.** Examples: sensitive data in a model output, an agent action outside its remit, a successful injection, a harmful or false customer-facing answer, and loss of a model or vendor.
3. **Log enough to reconstruct events.** The NCSC advises recording enough to spot suspicious activity, including LLM inputs and outputs and tool or API use, and notes that failed tool or API calls could reveal earlier stages of an attack [2].
4. **Pre-authorize a kill switch.** Name who can disable an agent or revoke its credentials, and test that it works. Limit blast radius by design: the NCSC says the worst case is an attacker having direct access to the tools and APIs the model can use, and recommends designing for that scenario [2].
5. **Plan for model unavailability.** Identify single-model dependencies, document the effect of a 30-day outage, keep an alternative or earlier-generation model as a fallback, use model-agnostic interfaces, and confirm how the vendor signals suspension or deprecation.
6. **Decide who you notify and when.** Decide who owns incident communications and list internal owners, affected customers and the vendor. CISA's AI Cybersecurity Collaboration Playbook describes voluntary sharing of cybersecurity information with CISA and partners through the Joint Cyber Defense Collaborative; it states that it does not impose requirements or mandate actions, and that all actions under it are voluntary [3].
7. **Rehearse it.** NIST's profile aims to prepare for incidents and improve detection, response and recovery [1]. A one-hour tabletop on "our assistant leaked a customer record" or "our model vendor is offline for two weeks" will expose gaps faster than a document review.

## Practical implication

Start with items 1 and 4: a current list of what your AI systems can touch, and a tested way to switch them off. Everything else in the plan depends on those two.

## Sources

1. [Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (SP 800-61 Rev. 3)](https://csrc.nist.gov/pubs/sp/800/61/r3/final), NIST, 2025-04-03
2. [Prompt injection is not SQL injection (it may be worse)](https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection), UK National Cyber Security Centre, 2025-12-08
3. [AI Cybersecurity Collaboration Playbook](https://www.cisa.gov/resources-tools/resources/ai-cybersecurity-collaboration-playbook), CISA, 2025-01-14

## How Sinthetix helps

An engineering studio for AI agents, automation, and internal tooling. We build the systems that make operators scale.

[Our services](https://sinthetix.com/services) | [Talk to us](https://sinthetix.com/contact)

Sinthetix is an AI engineering studio. We ship agents, automation, and internal tools for operators who need results, not reports. [About Sinthetix](https://sinthetix.com/about)