Learning Objectives

After completing this lecture, you will be able to:

• Understand the key concepts of ai incident response: what to do in a government context

• Apply knowledge of stop, document, report

• Apply knowledge of who to contact

• Identify next steps for applying these concepts in your role

Key Topics Covered

• Step-by-step: stop, document, report
• What to preserve
• Downloadable quick-response card

Why This Matters for Government

Government agencies face unique challenges when it comes to AI adoption. This lecture addresses these challenges head-on by providing all government employees with the knowledge and frameworks needed to navigate AI in the public sector responsibly and effectively.

As part of the L1 (AI Aware) curriculum, this lecture builds on the foundational principle that every AI system in government ultimately serves citizens. Whether you are working with AI tools daily or setting strategy for your agency, understanding ai incident response: what to do is essential for responsible, effective government AI adoption.

Lecture URL: https://skill.re/learn/govt/ai-incident-response-what-to-do.php

======================================================================

TRANSCRIPT: AI Incident Response: What to Do

======================================================================

What you will learn: Step-by-step response to AI incidents. Stop, document, report. Who to contact. What to preserve.

Something went wrong. An AI system exposed data. Made a catastrophically wrong decision. Was compromised in a cyberattack. Or you suspect something is wrong.

What do you do immediately? What do you do in the first hours? What's the playbook?

This lecture is about incident response for AI systems.

WHY THIS MATTERS FOR GOVERNMENT

The first hours after an AI incident are critical. What you do in those hours determines whether the incident is contained or spreads. Whether evidence is preserved or lost. Whether liability is minimized or maximized.

Having a plan and understanding your role in it is essential.

INCIDENT RESPONSE PLAYBOOK

Step 1: STOP (Immediate Actions)

As soon as you suspect an AI incident:

• Stop using the system. If you suspect the system is compromised or behaving badly, don't use it further.

• Notify your supervisor immediately. Don't wait for an official report. Verbal notification is fine initially.

• Preserve evidence. Don't delete anything. If you have screenshots, outputs, logs—save them. Don't modify anything.

• Isolate if possible. If the system is causing harm, try to limit its access or shut it down (if you have that authority). But don't do anything that destroys evidence.

• Do not panic and do not cover up. Don't try to "fix" the problem yourself. Don't try to hide it.

Step 2: DOCUMENT (First Hours)

Document what you know:

• What happened? Describe the incident as clearly as you can.

• When did it happen? Date, time, how long has it been occurring?

• Who is affected? How many people? What information is involved?

• How do you know? What did you observe that made you aware of the incident?

• What is the impact? What are the consequences of this incident?

Write this down. Save it. Don't rely on memory.

Step 3: REPORT (Within Hours)

Report the incident to the right people. In order of priority:

• Your supervisor (if you haven't already)

• Your agency's security team (usually IT Security or Chief Information Security Officer)

• Your agency's incident response team (if one exists)

• Your agency's privacy office (if PII is involved)

• Your agency's legal office (if legal implications exist)

Have a conversation. Say: "I'm reporting a potential AI system incident. Here's what I've observed."

They will determine next steps.

Step 4: COOPERATE (Ongoing)

Your agency's incident response team will take over. Your role is to:

• Answer questions about what you observed

• Provide any documentation you have

• Follow their instructions

• Maintain confidentiality (incidents under investigation are usually confidential)

Step 5: FOLLOW UP

After the incident is resolved:

• Ask what happened

• Ask what's being done to prevent recurrence

• Ask how you'll be notified of outcomes

• If it was a serious incident, there might be a lessons-learned meeting

SPECIFIC INCIDENT TYPES

Type 1: Data Exposure

You believe the AI system exposed PII or other sensitive data.

Immediate: Stop using the system. Preserve any evidence of what was exposed.

Report to: Your security team and privacy office immediately.

Type 2: Wrong Decision

The AI system made a decision that harms someone (denied them a benefit they qualified for, etc.).

Immediate: Stop using the system for that purpose. Document the harm.

Report to: Your supervisor, the system owner, and any relevant legal/compliance office.

Type 3: System Compromise

You suspect the AI system was hacked or manipulated.

Immediate: Stop using the system. Don't touch anything. Preserve evidence.

Report to: Your security team immediately.

Type 4: Unexpected Behavior

The system is producing outputs that are wrong, biased, or unexpected.

Immediate: Document examples of the unexpected behavior.

Report to: The system owner/team and your supervisor.

ANTI-PATTERNS / MISUSE RISKS

Anti-Pattern 1: Trying to Fix It Yourself

You notice the system is behaving badly. You try to reconfigure it or "fix" it yourself.

Risk: You destroy evidence. You make the problem worse. You violate policy.

Anti-Pattern 2: Waiting Too Long to Report

You observe something suspicious but you're not sure it's a real incident. You wait to see if it resolves itself.

Risk: The problem spreads. More people are affected. Recovery becomes harder.

Anti-Pattern 3: Reporting Casually

You mention the incident to a colleague: "Hey, the AI system did something weird."

Risk: The incident isn't formally logged. Response is delayed or doesn't happen.

Anti-Pattern 4: Overestimating or Underestimating the Incident

You panic and report something minor as catastrophic, or you downplay something serious.

Risk: Either way-cry-wolf scenario or delayed response.

Be accurate. Describe what you observed factually.

PRACTICE / REFLECTION PROMPTS

• In your agency, who is responsible for AI incident response? Do you know how to reach them?

• If you suspected an AI incident, what's your first action?

• If you observed the AI system making a wrong decision that affected someone, what would you do?

KEY TAKEAWAYS

• Stop using the system. Don't make the problem worse.

• Document immediately. What happened, when, impact, evidence.

• Report to the right people. Supervisor, security team, incident response team.

• Preserve evidence. Don't delete, modify, or cover up anything.

• Cooperate with incident response. Answer questions, provide documentation.

• Don't try to fix it yourself. Let the experts handle it.

TERMS / GLOSSARY ITEMS

Incident: An event where an AI system has failed, been compromised, or caused harm.

Incident Response: The process of addressing a security incident or system failure.

Evidence Preservation: Keeping records, logs, and documentation from the incident.

Root Cause: The underlying reason an incident occurred.

You're using an approved AI system to process benefit applications. You notice it's approving applications at a much higher rate than usual. The system is approving people who clearly don't qualify.

You have 2 hours before the approvals go into effect.

What you do:

• Stop processing applications immediately. Don't approve or deny anything further.

• Document what you observed: "On [date/time], I noticed the system approving applications that clearly don't meet eligibility criteria. I reviewed [X] applications and found [Y]% were incorrectly approved. This has been occurring for approximately [duration]."

• Call your supervisor: "I've observed a potential serious problem with the AI system approving applications. I've documented it. We need to notify security and stop processing immediately."

• Notify your security team and system owner.

• Cooperate while they investigate.

This quick response prevents hundreds of people from being incorrectly approved and avoids a much larger crisis.

10 minutes.

Identify your agency's incident response process for AI systems:

• Who leads incident response?

• How do you report an incident?

• What's the escalation path?

• What should you preserve as evidence?

If you can't answer these, find out.

Incident response is serious business. If you suspect something is wrong with an AI system, report it. Don't minimize it. Don't cover it up. Quick reporting limits damage and protects your agency.

Government AI CLUB Certification Program

Level 1: AI Aware | How AI Changes the Threat Landscape | Lecture 4.5

A GOVT.CLUB initiative.

<- 1.4.5 Prompt Injection and Manipulation 1.5.1 Algorithmic Fairness in Government ->

Start Your CLUB Certification

This lecture is part of L1: AI Aware—8 hours of comprehensive government AI training.

Explore CLUB Certification

Related Lectures

L1 1.4.1—How AI Changes the Threat Landscape 10 min - Video

L1 1.4.2—Recognizing AI-Generated Threats 10 min - Video + Exercises

L1 1.4.3—Data Leakage: When Sensitive Info Enters AI 10 min - Video + Scenarios

Frequently Asked Questions

What will I learn in AI Incident Response: What to Do?

In this 10 min video + checklist lecture, you will Step-by-step: stop, document, report. Who to contact. What to preserve. Downloadable quick-response card

What level is AI Incident Response: What to Do?

This is a Level 1 (AI Aware) lecture, part of Chapter 1.4 \u2014 Safety and Security. It is designed for all government employees.

How long is lecture 1.4.6?

Lecture 1.4.6 (AI Incident Response: What to Do) takes 10 min. It is delivered as a video + checklist format.

Do I need prerequisites for AI Incident Response: What to Do?

This lecture is part of L1 (AI Aware). Prerequisites: None.

What is the CLUB Certification?

CLUB (Community Leading Unified Benchmarks) is a maturity-based AI certification for government professionals with 5 levels (L1-L5), 215 lectures, and 25 chapters aligned with NIST AI RMF, OMB, and GAO frameworks.