AI Incident Response.

The set of processes, roles, and playbooks an organisation uses to detect, contain, investigate, communicate, and recover from incidents involving AI systems. It belongs to the AI & ML Security category of cybersecurity.

The set of processes, roles, and playbooks an organisation uses to detect, contain, investigate, communicate, and recover from incidents involving AI systems.

AI incident response extends classical incident response (NIST SP 800-61) to AI-specific events: prompt-injection abuse, agent runaway, model jailbreak in production, harmful or biased outputs at scale, training-data leakage, model theft, supply-chain compromise, and physical or financial damage caused by autonomous decisions. Response activities use AIBOMs to identify affected systems, model registries for rollback, prompt and output logs for forensics, and red-team scenarios to triage. Regulators are formalising obligations: the EU AI Act requires reporting of serious incidents involving high-risk AI, and the OECD AI Incidents Monitor and US AI Safety Institute publish taxonomies. Mature programs integrate AI incidents with SOC, privacy, legal, and trust-and-safety workflows.

Defences for AI Incident Response typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: AI IR, Generative AI incident response.