March 14 2026, 11:47 AM CET. Acme.ServiceAssist v1.0, Tier-1 Annex III customer-service agent, in production since November 2025, 14 million queries served, has its seventh escalated ticket in twelve minutes. Same shape each time: customer asks about product-warranty terms; agent confidently cites a 36-month warranty period; customer pulls the manufacturer documentation that clearly says 24 months. By 11:55 AM the customer-service operations supervisor is on a bridge with the system owner; by 12:03 PM the AI Red Team lead has confirmed the agent's RAG corpus contains a stale Q4 2024 warranty document that was supposed to be retired and never was; by 12:08 PM the Chief AI Officer joins and asks the question that defines the next 17 days: "What's the runbook? What are we declaring? Who do we have to notify, on what clock, in what order, and what do we do in the next four hours so the answer to the regulator's first question isn't 'we improvised'?" This lesson is the answer. It is the operational sibling to the lesson 025 AI Incident Response Policy, the five-phase runbook (Detect → Triage → Contain → Eradicate & Recover → Report & Learn) adapted to AI; the 4-tier severity matrix; the four-hour Article 3(49) clock triggering Article 73's fifteen-day machinery; the twelve-card containment deck; war-room composition by severity; the 28-field incident-record schema; seven common failures; and the full Acme.ServiceAssist worked example walked from 11:47 AM March 14 through CAPA close March 31. By the April 8 AIGC retrospective the runbook prints in fourteen pages, the deck prints to twelve laminated cards on the war-room wall, and the question the CAIO asked at 12:08 PM has a one-line answer anyone in the room can read off the wall.

Why a Dedicated AI Incident Runbook in 2026

Every mature enterprise has a CSIRT runbook, typically NIST SP 800-61 Rev. 2-aligned, often ISO/IEC 27035-aligned, supplemented by a GDPR Article 33 / 34 personal-data-breach playbook with the 72-hour clock memorized. None of those, alone or in combination, are sufficient for AI incidents in 2026. The lesson 025 AI Incident Response Policy names the obligation; this lesson is the L4 leadership operational instrument that turns it into a runbook on the war-room wall.

Six 2026 forcing functions converge on a dedicated AI runbook:

• Article 73 clock with Article 3(49) trigger. The Article 73 statutory machinery, 15-day report to the national MSA and the AI Office; 2 days for widespread fundamental-rights infringement or serious-and-irreversible critical-infrastructure disruption; 10 days for death, depends on a defensible Article 3(49) assessment. A general CSIRT runbook lacking the four-hour Article 3(49) step misses the clock by default. Article 99(3) penalty exposure: €15M / 3% of global turnover; Article 99(2) €35M / 7% if Article 5 prohibited practice surfaces.
• AI-specific failure modes CSIRT runbooks miss. Hallucination cascade (single bad context propagates to thousands of users); prompt-injection blast-radius (one crafted instruction reaches every downstream tool); agent tool-misuse (irreversible action a human approver would have caught); fairness-slice failure (model degrades on a protected cohort while aggregate metrics stay green); RAG corpus poisoning (one stale or attacker-controlled document corrupts every retrieval); vendor upstream model swap (foundation-model provider updates the model under contract without a deployer-side regression test). Each pattern has an AI-native containment action no CSIRT runbook contains.
• Article 25(2) + Article 26(4) + Annex XII counterparty loops. Deployer owes the provider an Article 26(4) notification; provider owes the upstream foundation-model provider an Article 25(2) cooperation loop; Annex XII propagates to importers and distributors. A runbook that stops at "notify the CISO" misses three named legal counterparties.
• Article 86 affected-party right to explanation. Where the incident affects identifiable consumers (lesson 057), the runbook must trigger affected-party notification with right-to-explanation content. The Acme.ServiceAssist incident affected 312 customers, Article 86 applies.
• Article 72 PMM back-feed + eval-pipeline regression. An incident not fed back into the PMM plan (lesson 080) and the eval-pipeline regression suite is a recurrence-in-waiting. Phase 4 Eradicate & Recover is the bridge to the engineering pipeline.
• Board dashboard KPI 8 + ERM aggregation. The lesson 087 dashboard's KPI 8 (Article 73 incidents YTD + 15-day timeliness) is reported quarterly to the board and aggregated into ERM. A runbook that does not generate the 28-field schema feeding KPI 8 leaves the audit committee's 10-K Item 105 disclosure as qualitative narrative rather than evidence-backed reporting.

The runbook's standing. It is the load-bearing operational artifact between the lesson 025 L2 policy and the lesson 089 Article 73 tabletop drill. Policy defines what is owed; runbook defines what happens in the next four hours; tabletop is the rehearsal that proves the runbook works under pressure. The three together are what a Big-Four advisor, an ISO 42001 surveillance auditor, an EU AI Office inspector, and an SR 11-7 prudential examiner all request as a bundle when testing AI incident-response maturity.

The Five-Phase D-T-C-E-R Lifecycle

The runbook adapts NIST SP 800-61's four-phase model into a five-phase AI-native sequence, Detect, Triage, Contain, Eradicate & Recover, Report & Learn, with explicit clocks, named roles, and AI-specific containment patterns. Phases are sequential but overlap: Triage runs in parallel with first Contain actions for any Sev-1/2; Report begins clock-tracking the moment Triage confirms an Article 3(49) finding.

Phase 1 - Detect.

The runbook accepts incident signals from eight detection sources, prioritized by signal-quality and time-to-action:

• PMM signals. Article 72 PMM dashboards (lesson 080): drift detector, fairness drift, performance drift, data-quality drift, refusal-rate cohort shift. Highest-quality, automated, sub-hour latency. Owner: PMM head.
• Red-team finding closure escalation. A red-team finding (lesson 084) the engineering team cannot close within severity-bound SLA. Owner: Red Team lead.
• User in-product feedback loop. Thumb-down, "report this answer", customer-service ticket clustering (the Acme signal was seven tickets in twelve minutes). Owner: System owner / Trust & Safety.
• Deployer-side escalation. Article 26(4) deployer notification of a serious incident. Owner: Provider Relations / Legal.
• Vendor upstream notification. Article 25(2) cooperation loop: upstream foundation-model provider notifies of model swap, capability change, or upstream incident. Owner: Procurement / Vendor Management.
• External researcher disclosure. Responsible-disclosure channel; bug-bounty; academic publication; press inquiry. Owner: Security / Legal.
• SIEM correlation. Splunk / Sentinel / Chronicle anomaly detection on tool-call frequency, prompt-injection signatures, output classifiers. Owner: SOC.
• Regulatory inquiry. Article 89 information request from MSA, sectoral regulator, or DPA. Treated as a Sev-2 trigger regardless of underlying facts. Owner: Legal / DPO.

Detection-source-rate KPI. Healthy program: 40-60% PMM, 15-25% red-team / user-feedback, ≤10% external researcher, ≤5% regulator. >25% external-researcher signals internal monitoring is blind; >5% regulator signals compliance posture is failing. Feeds lesson 087 dashboard KPI 10 and lesson 084 red-team KPIs.

Intake within 60 minutes. Any incoming signal reaches the on-call commander within 60 minutes. The on-call commander is a named role (senior PMM owner business hours; Trust & Safety off-hours) with 24/7 rotation, published phone tree, and dedicated Slack / Teams channel. The 60-minute intake SLA is the precondition for the four-hour Article 3(49) clock.

Phase 2 - Triage.

Triage is the four-hour clock. The on-call commander runs the Article 3(49) assessment, five questions plus a decision matrix, and assigns severity. Output: a one-page memo signed by commander + system owner that authorises the rest of the runbook.

Article 3(49) four-hour assessment - five sequential questions:

• Q1 - Death or serious-injury attributable? Direct or indirect causal link to human death or hospitalisation. If yes: Sev-1; Article 73(1)(a) 10-day clock; CAIO + CRO + General Counsel paged ≤30 min.
• Q2 - Critical-infrastructure impact? NIS2-defined critical infrastructure disrupted/threatened. If yes: Sev-1; Article 73(1)(b) 2-day clock; NIS2 Article 23 reporting also triggered.
• Q3 - Fundamental-rights impact? Rights protected by Charter, Race/Employment/Gender Equality Directives, or GDPR. If widespread (multi-tenant/cohort/jurisdiction): Sev-1 + Article 73(1)(c) 2-day clock; if single-instance: Sev-2 + 15-day clock.
• Q4 - Substantial property or environmental damage? Material economic loss or environmental damage attributable. If yes: Sev-2 + Article 73(1)(d) 15-day clock.
• Q5 - Article 5 prohibited-practice surfaced? Social-scoring, real-time biometric categorisation (outside narrow exceptions), CBRN content generation, manipulative-techniques behaviour. If yes: Sev-1 + Article 99(2) €35M / 7% exposure; certificate-suspension risk; emergency disable required.

Five "no" answers and the incident is sub-Article 3(49) - Sev-3 or Sev-4. The triage memo documents the negative finding for Article 18 ten-year retention. "We didn't report and we didn't document why" is the worst position; documented negative finding is defensible.

Notification clock by severity. Sev-1: AIGC chair + CRO + CAIO + General Counsel paged ≤4h; board AI subcommittee chair ≤24h; war-room immediate. Sev-2: AIGC + CRO + CAIO ≤8h; war-room within working day. Sev-3: AIGC at next standing meeting (≤7d); system-owner-led with CAIO awareness. Sev-4: Compliance ticket; quarterly AIGC review.

Phase 3 - Contain.

Containment runs in parallel with Triage for Sev-1/2. The runbook ships with a twelve-card laminated deck on the war-room wall (section 5). Six AI-specific containment-pattern families:

• (i) Circuit-breaker disable. Hard-shutdown via feature-flag platform. Most aggressive; reserved for Sev-1 (Article 5 surfaced, irreversible-action risk, broad PII exfiltration, agent rogue action). ≤5 min. Owner: System owner + on-call SRE.
• (ii) RAG-corpus quarantine. Disable suspect corpus or document set; route to fallback or refuse-mode. Used for RAG poisoning, stale-content hallucination, attacker-controlled document upload. ≤30 min. Owner: RAG owner + Data Engineering.
• (iii) Tool-allowlist revocation. Revoke a specific tool from the agent's allowlist (disable "send_email", "execute_trade", "create_ticket"). Used for tool-misuse, prompt-injection-induced unauthorized action. ≤15 min. Owner: Agent platform.
• (iv) Memory wipe. Truncate session memory, vector store, or fine-tuned-adapter state to remove poisoned context. ≤60 min. Owner: Agent platform + ML Engineering.
• (v) Version rollback. Roll back to prior known-good model, prompt-template, or system-prompt version. Used for prompt regression, fine-tune-induced drift, vendor-side model swap. ≤30 min. Owner: ML Platform.
• (vi) Traffic-shed to fallback. Route 10/50/100% traffic to a deterministic fallback (rule-based, human-only, or service-unavailable deflection). Used when system cannot be diagnosed quickly but consumer impact must be capped. ≤15 min. Owner: Front-end / Edge Platform.

Every action is logged with timestamp, operator, and rollback path. The containment log is the audit trail the regulator inspects when asking "what did you do in the first four hours". Irreversible containment in Sev-1 (memory wipes that erase evidence; rollbacks that disable a legitimate fix) requires legal + engineering joint sign-off.

Phase 4 - Eradicate & Recover.

Phase 4 moves from "the bleeding has stopped" to "the system is back in production with the failure mode permanently addressed". Three sub-activities:

• Root-cause analysis. 5-Why, Fishbone (Ishikawa), or formal FRACAS-for-AI. The "for AI" adaptation extends classical FRACAS categories with AI-specific buckets: data-quality (training/retrieval/eval); model-architecture (capability/alignment/robustness); prompt-engineering (template/system-prompt/few-shot); tooling (allowlist/parameter-validation/output-handling); operational (monitoring/alerting/rollback); upstream-vendor (model swap/capability change/contract); deployment-environment (load/latency/dependency).
• Corrective + preventive action (CAPA). Corrective closes the specific failure; preventive prevents recurrence. Acme's corrective: RAG corpus refresh. Preventive: document-retirement workflow + eval-pipeline regression test for warranty-content queries. Both tracked in the CAPA register with owner, due date, and verification evidence.
• Re-deploy with stay-out monitoring. System re-enters production with elevated monitoring for 7-30 days depending on severity: heightened PMM thresholds; daily red-team probes against the failure mode; user-feedback close-loop. Stay-out exits only on documented sign-off from PMM + Red Team + System Owner.

Documentation cascade. Phase 4 generates Article 18 ten-year-retention artifacts: model/system-card update; eval-pipeline regression test (lesson 056); ML-BoM update if upstream model changed; FRIA review if fundamental-rights impact surfaced; Annex IV TDF revision if Article 25(1)(a) substantial-modification triggered. Skipping the cascade is the legal-exposure failure mode, the incident closes operationally but the documentation does not survive a surveillance audit.

Phase 5 - Report & Learn.

Phase 5 bridges the incident to the regulator, affected parties, upstream vendor, downstream deployer, and the program's governance machinery. Six workstreams:

• Article 73 supervisory-authority report. Initial report within applicable clock (10/2/15 days); complete report after RCA closes; iterative dialogue with the MSA via single point of contact (General Counsel).
• Article 86 affected-party notification. Where consumers were affected, the right-to-explanation triggers consumer notification co-designed by Customer Success + Legal + Privacy + Communications, sent before public communications where possible. Acme's 312 customers received written notification within 5 days.
• Article 25(2) upstream-vendor cooperation. Deployer / downstream provider notifies the upstream foundation-model vendor and shares RCA findings, contractually required under Article 25(2). Acme notified its vendor on day 6.
• Annex XII deployer-loop. Where the affected system is a building block for downstream deployers, those deployers are notified under Annex XII.
• AIGC retrospective + board briefing. Structured retrospective within 30 days of close; board AI subcommittee briefing for Sev-1/2. Retrospective feeds lesson 087 KPI 8 and the lesson 074 AIRA breach register.
• Lessons-learned + program back-feed. Lessons feed: AI Incident Response Policy (lesson 025); the runbook itself (containment-deck updates, severity-matrix recalibration); next Article 73 tabletop (lesson 089); eval-pipeline regression suite (lesson 056); PMM monitoring plan (lesson 080); red-team threat model (lesson 084); model/system card; ML-BoM. Back-feed is the institutional learning that prevents recurrence.

Severity Matrix + War-Room Composition + Article 3(49) Clock

The severity matrix is the runbook's most-used artifact. It sits on the war-room wall, in the on-call commander's runbook, and at the front of the incident-record template. Four tiers, each with criteria, war-room composition, notification clocks.

Sev-1 (critical), the war room.

Criteria (any one). Article 5 prohibited surfaced; CBRN content; broad PII exfiltration (≥500 records or ≥10 EU subjects with special-category data); agent irreversible action (financial transaction, external message, asset transfer); consumer death/serious-injury; certificate-suspension risk; regulator emergency order. Article 73 clock. 2 or 10 days. War room. Red Team lead + CISO + CAIO + CRO + General Counsel + DPO + External counsel + Communications. Cadence. Stand-up every 4h initially, every 12h from day 3, daily from day 7. Closure. AIGC + board AI subcommittee chair joint sign-off.

Sev-2 (high).

Criteria. Article 15 robustness failure with active consumer impact (Acme.ServiceAssist hallucination affecting 312 customers landed here); persistent cross-tenant prompt-injection; system-prompt extraction; Annex III §5(b) fairness disparity surfaced with identifiable affected cohort. Article 73 clock. 15 days for single-instance fundamental-rights / property-environment damage. War room. Red Team lead + CISO + CAIO + CRO + Legal + DPO. Drop External counsel + Communications versus Sev-1 (engaged on-call, not in standing war room). Cadence. Daily initially, 48h from day 7. Closure. AIGC sign-off; CAIO + CRO joint sign on CAPA.

Sev-3 (medium).

Criteria. Single-turn jailbreak with limited blast radius; cohort refusal-rate drop within tolerance but warranting investigation; RAG poisoning PoC (not yet exploited); minor SLA regression not consumer-affecting. Article 73 clock. Not triggered. War room. Red Team lead + CAIO + System owner. Cadence. Twice-weekly stand-up. Closure. CAIO sign-off; AIGC awareness next meeting.

Sev-4 (low).

Criteria. Edge case with negligible impact; documentation gap; one-off non-reproducible complaint. Article 73 clock. Not triggered. War room. System owner + Compliance ticket. Cadence. Normal engineering. Closure. System owner; quarterly AIGC compliance review.

Severity reassessment. Reassessed at four points: (a) four-hour triage close; (b) 24h when initial RCA produces first findings; (c) any new fact (additional affected parties, regulator inquiry, press disclosure, vendor notification); (d) CAPA-close. A Sev-3 surfacing a 500-person PII exposure at hour 24 becomes Sev-1; war-room composition shifts accordingly. On-call commander can upgrade unilaterally; downgrade requires CAIO sign-off.

The four-hour clock. Starts at intake (the moment the incident reaches the on-call commander, not the underlying event time). Within four hours the runbook produces: (i) signed Article 3(49) memo; (ii) severity assignment; (iii) notification log showing AIGC + CAIO + CRO paged per matrix; (iv) initial containment action (or documented decision to wait pending diagnosis); (v) Article 73 clock-start timestamp if triggered. Missing four hours is the most common cause of a missed Article 73 clock, Article 99(3) €15M / 3% lands on the four-hour failure even if every subsequent step is perfect. The runbook treats four hours as an enterprise SLA enforced by the on-call rotation, AIGC chair, and audit-committee oversight.

Twelve-Card Containment Deck + 28-Field Incident Record

The runbook ships with two operational artifacts: a twelve-card containment deck for the war-room wall, and a 28-field incident-record schema for the case-management system. Together they are the operational instruments that turn the policy into action and the action into evidence.

The twelve-card containment deck.

Each card maps one AI failure-scenario to one containment action. Cards are laminated, numbered, and mounted on the war-room wall in two columns of six. Each card has six fields: title, trigger, prerequisites, command / runbook script reference, expected outcome, fallback. The standard twelve:

• Card 1 - Hallucination cascade. Trigger: customer-facing factual error replicated across ≥10 tickets in 24h. Action: traffic-shed 100% to deterministic fallback; RAG corpus quarantine; investigate source document. Time: ≤30 min. Owner: System owner.
• Card 2 - Prompt-injection blast-radius. Trigger: confirmed cross-tenant prompt-injection or system-prompt extraction. Action: tool-allowlist revoke for affected tools; input-validation layer hot-patch; version-rollback if patch unavailable. Time: ≤15 min. Owner: Agent platform.
• Card 3 - Agent rogue action. Trigger: agent invoked a tool that caused an irreversible external action (transfer, send, post). Action: circuit-breaker disable; reverse the action via downstream API where possible; tool-allowlist revoke. Time: ≤5 min. Owner: Agent platform + Operations.
• Card 4 - Fairness slice failure. Trigger: cohort-specific accuracy or refusal-rate drop ≥5 percentage points beyond baseline. Action: traffic-shed affected cohort to fallback; preserve evidence; engage FRIA review. Time: ≤60 min. Owner: ML Engineering + FRIA owner.
• Card 5 - RAG corpus poisoning. Trigger: confirmed attacker-controlled or stale document affecting retrieval. Action: corpus quarantine; refresh from gold source; eval-regression test on affected query class. Time: ≤30 min. Owner: RAG owner.
• Card 6 - Vendor upstream model swap. Trigger: foundation-model vendor notifies a model update or deployer-side detects unannounced capability shift. Action: pin to prior model version where contractually possible; regression suite run; Article 25(1)(a) substantial-modification assessment. Time: ≤4 hours. Owner: ML Platform + Procurement.
• Card 7 - PII exfiltration via output. Trigger: output classifier flags PII pattern in agent response or red-team confirms extraction. Action: output-classifier threshold tighten; tool-allowlist revoke for outbound; GDPR Article 33 parallel-clock activated. Time: ≤30 min. Owner: Privacy + ML Engineering.
• Card 8 - Article 5 prohibited surfacing. Trigger: red-team or PMM detects production behaviour matching an Article 5 prohibition (manipulation, social-scoring, biometric categorisation). Action: circuit-breaker disable; AIGC chair + CAIO + Legal paged ≤30 min; certificate-suspension defence prepared. Time: ≤5 min. Owner: CAIO + Legal.
• Card 9 - CBRN content generation. Trigger: red-team or external researcher demonstrates CBRN-content elicitation. Action: circuit-breaker disable on affected pathways; refusal-classifier patch; CAISI / AISI / national-security notification per playbook. Time: ≤5 min. Owner: Trust & Safety + Legal.
• Card 10 - Memory poisoning. Trigger: confirmed persistent-memory attack or cross-session leakage. Action: memory wipe; session-isolation hot-fix; eval-regression on memory-handling. Time: ≤60 min. Owner: Agent platform.
• Card 11 - Eval-pipeline regression detected. Trigger: pre-deployment eval suite (lesson 056) reports regression on production-equivalent suite. Action: block deployment; rollback if already deployed; root-cause on training / fine-tune pipeline. Time: ≤30 min. Owner: ML Platform.
• Card 12 - Regulator emergency order. Trigger: Article 89 information request, market-surveillance-authority emergency measure, or notified-body certificate-suspension notice. Action: circuit-breaker disable on scope of order; Legal-led response; CAIO + CRO + board chair paged ≤4 hours; preserve all evidence. Time: ≤30 min. Owner: General Counsel.

The deck is rehearsed at quarterly tabletops (lesson 089). Cards are added as new failure patterns emerge from red-team findings, PMM signals, or external researcher disclosures; the AIGC ratifies deck updates quarterly.

The 28-field incident-record schema.

Every incident, Sev-1 through Sev-4, produces a structured record in the case-management system. The schema is the audit trail for ISO 42001 Clause 9 / A.9 / A.10, EU AI Act Article 18 ten-year retention, SR 11-7 incident-tracking, and the board dashboard's KPI 8. The 28 fields:

• 1. incident-ID (UUID); 2. severity (Sev-1/2/3/4); 3. system-ID (from AI inventory, lesson 011); 4. system version + commit hash; 5. detection source (one of eight); 6. detection-time (UTC); 7. triage-time (UTC, ≤4h from detection); 8. AIGC chair notification time; 9. Article-73 clock start-time (or "N/A, sub-3(49)"); 10. containment actions log (sequence of card # + timestamp + operator); 11. evidence-pointers (S3 path / vault location for logs, traces, sample outputs); 12. root-cause category (FRACAS-for-AI taxonomy); 13. corrective action + owner + due date; 14. preventive action + owner + due date; 15. recovery-time-actual (UTC of system back to production); 16. regulator-notified-y/n (MSA, AI Office, sectoral); 17. Annex-XII deployer-notified y/n + list; 18. Article-25(2) upstream-vendor-notified y/n + date; 19. Article-86 affected-parties-notified y/n + count; 20. lessons-learned summary (≤500 words); 21. eval-pipeline regression test added y/n + test-ID; 22. model-card/system-card updated y/n + version; 23. ML-BoM updated y/n; 24. AIRA breach y/n + which KRI; 25. FAIR loss-event realised € (post-incident actual vs lesson 086 modelled); 26. public-disclosure y/n + channel; 27. retrospective-date + attendees; 28. sign-off (system owner + CAIO + CRO + General Counsel + date).

The 28-field schema is the document an auditor pulls into evidence. Missing fields are the regulator's first follow-up question, "you reported the incident but field 21 says no eval-pipeline regression test was added; what assurance do you have that recurrence is prevented?", and the program that cannot answer fails the maturity test.

Worked Example - Acme.ServiceAssist March 14 2026 + Seven Common Failures

The Acme.ServiceAssist hallucination, walked phase-by-phase.

Day 0 - March 14 2026, Saturday. 11:47 AM Customer-service operations supervisor escalates seven tickets in twelve minutes, all on the warranty 36-vs-24-month discrepancy. Detection source: user in-product feedback (cluster). On-call commander (PMM owner) paged 11:51 AM. 11:55 AM System owner joins; RAG owner confirms a Q4 2024 warranty addendum (superseded) is in the active retrieval index. 12:03 PM Containment Card 5 triggered, RAG-corpus quarantine; refresh from gold source initiated. Containment time: 16 minutes from detection. 12:08 PM CAIO joins. On-call answers the CAIO's question: "Triage memo in 3.5 hours; Article 3(49) before four-hour mark; preliminary Sev-2; ≤312 customers affected; single-instance Article 73(1)(c); 15-day clock starts 11:51 AM if confirmed." 3:30 PM Triage memo signed. Article 3(49) Q1-Q4-Q5 no; Q3 yes (single-instance fundamental-rights, 15-day clock); Sev-2. War room: Red Team + CISO + CAIO + CRO + Legal + DPO. AIGC chair notified 3:42 PM (within 8-hour Sev-2 window). Article 73 clock start: March 14 11:51 AM. Deadline: March 29. 4:15 PM RAG refresh complete; eval-regression on warranty queries passes 100%; traffic resumed 4:18 PM. Total containment-to-resume: 4h 27m.

Day 1-7 - Eradicate & Recover. March 15-16 RCA: 5-Why identifies the Q4 2024 addendum was not moved to "retired" S3 prefix when superseded in Q1 2025; RAG indexer's full-bucket scan re-included it; no eval-pipeline regression existed for warranty content. FRACAS category: data-quality (retrieval) + operational (monitoring). March 17-20 CAPA. Corrective: manual retirement sweep. Preventive: (i) automated document-retirement workflow with mandatory metadata tag; (ii) eval-pipeline regression for top-50 warranty / product-fact queries; (iii) PMM alert on factual-claim drift via output-classifier sampling; (iv) quarterly RAG-corpus review by Trust & Safety. March 21-30 stay-out. Elevated PMM; daily red-team probes; user-feedback close-loop. No recurrence. Stay-out exit March 31.

Day 1-17 - Report & Learn. March 17 Article 73 initial report filed (day 3, well within 15 days). Single point of contact: General Counsel. Covers system ID, incident description, preliminary 73(1)(c) classification, 312 affected, containment, commitment to file complete report. March 19 Article 86 notification to 312 customers, co-designed by Customer Success + Legal + Privacy + Communications; commercial-redress (honouring the misquoted 36-month warranty) approved by CRO + General Counsel + CFO. Cost: ~€47K redress + €9K notification = €56K. March 20 Article 25(2) vendor notification; preliminary RCA shared; vendor confirms model not implicated (RAG defect, not model). No Annex XII (no downstream deployers). March 31 Complete Article 73 report filed (day 17). MSA acknowledges April 7; follow-up on eval-regression scope answered April 11; case closed April 18. April 8 AIGC retrospective, 90-min; 28-field record reviewed; lessons feed: lesson 025 policy (no changes, runbook performed); runbook (Card 5 fine-tuned); next tabletop scenario (RAG poisoning); eval-pipeline; PMM; red-team threat model; model card → v1.0.1; ML-BoM updated. Board briefing April 22; KPI 8 reports 1 Article 73 incident YTD, 100% within 15-day window.

FAIR back-test. Lesson 086 modelled this scenario at €0.4M-€2.1M (Scenario 11 - RAG hallucination, 100-1000 customer scale, single-instance fundamental-rights characteristic). Realised: €56K commercial-redress + €0 fine + €0 litigation + €180K internal time = €236K. Within the P25 band. Feeds the lesson 086 Q3 ALE₉₅ calibration.

Seven common AI incident-response failures (and the runbook's structural prevention).

• Failure 1 - Treating an AI incident as cyber-only. The CISO leads; the CAIO is absent or arrives late; AI-specific failure modes (fairness slice, hallucination cascade, prompt-injection blast radius) are misdiagnosed as system outages. Runbook fix: war-room composition by severity mandates CAIO co-lead on Sev-1 / Sev-2; the on-call rotation is staffed by AI-trained commanders, not generic SOC analysts.
• Failure 2 - Skipping the four-hour Article 3(49) assessment. The team gets pulled into containment, the four-hour mark passes, and the 15-day Article 73 clock either misses (because the start-time was never logged) or starts late (because awareness was deemed to begin at root-cause-confirmed). Runbook fix: the four-hour clock is an enterprise SLA; the on-call commander cannot close the bridge without the signed triage memo; AIGC chair has dashboard visibility on four-hour SLA compliance.
• Failure 3 - Containment without root-cause. The bleeding stops; the team breathes; nobody runs RCA; the same incident recurs 60 days later. Runbook fix: the Eradicate & Recover phase is gate-checked by AIGC sign-off; CAPA register has named owners + due dates; stay-out period has documented exit criteria.
• Failure 4 - No Article 25(2) upstream-vendor loop. The incident is treated as a deployer-only event; the upstream vendor is not notified; the same model defect recurs at another deployer 30 days later; both deployers face independent Article 73 reporting without coordination. Runbook fix: Phase 5 has Article 25(2) as a named workstream; the vendor-management function has a 24-hour notification target; the MSA's first follow-up question on upstream coordination has a documented answer.
• Failure 5 - No Annex XII deployer-loop. The provider closes the incident but does not notify downstream deployers; downstream deployers carry the same defect into their own Article 73 exposure unknowingly. Runbook fix: Phase 5 has Annex XII as a named workstream; the system inventory (lesson 011) lists downstream deployers; the General Counsel maintains the deployer-notification template.
• Failure 6 - No eval-pipeline back-feed. The CAPA closes operationally but no regression test is added to the eval pipeline; the same defect re-emerges at the next training or fine-tune cycle. Runbook fix: the 28-field incident record has field 21 (eval-regression test ID); the AIGC retrospective verifies field 21 populated; the next lesson-056 eval-pipeline review surfaces missing field 21 as a finding.
• Failure 7 - Public disclosure without legal / communications coordination. An engineer posts a write-up; a customer-success contact mentions the incident on a sales call; the press picks up an inconsistent version; the MSA receives the press version before the Article 73 report. Runbook fix: Phase 5 has Communications as a named workstream; field 26 on the schema records public-disclosure channel and authority; the Sev-1 war room includes Communications by default; the External counsel coordinates on press inquiries.

Cross-Walk + Penalty Exposure + Aggregation Upward

The runbook is the load-bearing operational artifact at the intersection of EU AI Act, NIST AI RMF, ISO 42001, SR 11-7, ISO/IEC 27035, and NIS2. The cross-walk, reproduced in the runbook appendix and the regulator-correspondence binder, names the primary mapping per phase plus the Article 99 penalty band.

• EU AI Act: Articles 3(49) (serious-incident); 9 (risk management); 14 (human oversight); 15 (accuracy + robustness); 17 (QMS); 25(2) (upstream cooperation); 26 + 26(5) (deployer); 27 (FRIA); 43(4) (substantial-modification); 50 (transparency); 71 (registration); 72 (PMM); 73 (reporting); 86 (affected-party); 89 (regulator request); 99 (penalties); Annex IV §9; Annex XII (deployer-loop).
• NIST AI RMF: Manage 1.3 + 2.1 + 4.1; Measure 2.7 + 4.1; NIST AI 600-1 GAI Profile: 12 risks (especially confabulation, dangerous-or-violent-recommendations, harmful-bias, value-chain).
• ISO/IEC 42001: Clause 9 (performance evaluation); A.6.2.7 (AI response to issues); A.9 (operation + monitoring); A.10 (third-party).
• SR 11-7 / OCC 2011-12 / PRA SS1/23: Incident-response is one of the eight MRM pillars; the runbook is the L4 instrument operationalising it for LLM/agent models.
• ISO/IEC 27035 + NIS2 Article 23: 27035 information-security incident management complements (does not replace); NIS2 24h early-warning / 72h notification / one-month final report extends Phase 5 where the AI system is in NIS2 scope.

Penalty exposure. Article 99(3) €15M / 3% for Article 17, 26, 73 failures. Article 99(2) €35M / 7% if Article 5 surfaces (Card 8). Article 99(4) €7.5M / 1% for failure to provide information on Article 89 inquiry.

Aggregation upward. Runbook outputs feed three streams: (i) lesson 087 dashboard KPI 8 + KPI 9; (ii) lesson 074 AIRA breach register; (iii) lesson 086 FAIR ALE actuals back-testing modelled distributions. Audit committee references KPI 8 in 10-K Item 105 + Item 303 MD&A.

Key Takeaways

• A dedicated AI incident runbook is the L4 leadership instrument in 2026. Traditional CSIRT runbooks miss six AI-specific failure modes, hallucination cascade, prompt-injection blast radius, agent tool-misuse, fairness slice failure, RAG corpus poisoning, vendor upstream model swap, and miss the four-hour Article 3(49) clock that triggers the Article 73 fifteen-day machinery. The runbook is the operational sibling to the lesson 025 policy and the lesson 089 tabletop drill.
• Five-phase D-T-C-E-R lifecycle adapts NIST SP 800-61 to AI. Detect (eight named sources + 60-minute intake); Triage (four-hour Article 3(49) assessment + severity assignment); Contain (six containment-pattern families + twelve-card deck); Eradicate & Recover (FRACAS-for-AI + CAPA + stay-out period); Report & Learn (Article 73 + Article 86 + Article 25(2) + Annex XII + AIGC retrospective + program back-feed).
• Four-hour Article 3(49) clock is the single most important SLA. Five-question assessment: death/serious-injury, critical-infrastructure, fundamental-rights, property/environment, Article 5 prohibition. Signed triage memo; severity assignment; AIGC + CAIO + CRO notification per severity; Article 73 clock start-time logged. Missing the four-hour mark is the most common cause of a missed Article 73 clock, Article 99(3) €15M / 3% exposure.
• Severity matrix Sev-1/2/3/4 governs war-room composition. Sev-1, full war room (Red Team + CISO + CAIO + CRO + Legal + DPO + External counsel + Communications). Sev-2, drop External counsel + Communications. Sev-3 - Red Team lead + CAIO + system owner. Sev-4, system owner + Compliance ticket. Upward reassessment is unilateral; downgrade requires CAIO sign-off.
• Twelve-card containment deck operationalises six AI-specific patterns. Circuit-breaker disable; RAG-corpus quarantine; tool-allowlist revocation; memory wipe; version rollback; traffic-shed to fallback. Each card has named trigger, role, command-script reference, expected outcome, fallback, and time-to-execute estimate. The deck mounts on the war-room wall.
• 28-field incident-record schema is the audit-and-regulator artifact. Detection source through retrospective sign-off; field 21 (eval-pipeline regression test added) and field 18 (Article 25(2) upstream notified) are the two most-missed; missing fields are the regulator's first follow-up question. Article 18 ten-year retention.
• Seven common failures have structural prevention. Cyber-only framing (CAIO co-lead mandate); skipping four-hour assessment (SLA enforcement); containment without RCA (gate-check by AIGC); no Article 25(2) upstream loop (named Phase 5 workstream); no Annex XII deployer loop (named Phase 5 workstream); no eval-pipeline back-feed (field 21 audit); public disclosure without coordination (Communications in Sev-1 war room).
• The Acme.ServiceAssist March 14 2026 worked example demonstrates the runbook under load. 11:47 AM detection; 12:03 PM containment (16 minutes); 3:30 PM triage memo + Sev-2 + 15-day clock start; 4:18 PM full recovery (4h 27m); March 17 initial Article 73 report (day 3); March 19 Article 86 affected-party notification (312 customers); March 20 Article 25(2) vendor notification; March 31 complete report; April 8 retrospective. FAIR back-test: €236K realised vs €0.4M-€2.1M modelled (within P25-P50 band).