CHARLEE.AI KNOWLEDGE CENTER
Editable playbookPrintable PDFReference guide

AI Incident-Response Workspace

Open one authoritative incident record, determine severity, coordinate containment, preserve AI-specific evidence, and track recovery and remediation.

Incident intake

Record facts, not conclusions

Severity assessment

Use the highest credible impact
Consumer or rights impactDid the event affect eligibility, price, coverage, benefits, payment, investigation, appeal, communication, privacy, accessibility, or fair treatment?
Scale and propagationHow many consumers, claims, policies, transactions, users, jurisdictions, or downstream systems are affected or plausibly exposed?
Autonomy and controlDid a model or agent act, communicate, write, transact, or call tools beyond approved authority, and can it be stopped reliably?
Legal or regulatory exposureCould the event violate insurance, privacy, cybersecurity, consumer-protection, recordkeeping, discrimination, or market-conduct obligations?
Data and securityWas protected, proprietary, privileged, or regulated data exposed, altered, inferred, exfiltrated, or used outside approved purpose?
Financial and operational impactWhat payments, reserves, premiums, expenses, deadlines, service levels, or business processes are affected?
Detectability and reversibilityCan affected records and decisions be identified, explained, corrected, reprocessed, recalled, or reversed before further harm?
Evidence integrityAre prompts, outputs, model versions, configurations, tool calls, logs, approvals, and source data available and trustworthy?

Response phases

Check actions and record owners
P1 · Detect and intake
Objective: Create one authoritative incident record and protect the signal from being lost or informally handled. Lead: Incident coordinator
P2 · Triage and activate
Objective: Confirm scope, establish command, and mobilize the right insurance, technical, legal, and control functions. Lead: Incident commander
P3 · Contain and preserve
Objective: Stop additional harm while preserving evidence and essential service. Lead: Technical and business leads
P4 · Assess impact and cause
Objective: Determine what happened, why controls failed, who or what was affected, and what must be corrected. Lead: Investigation lead
P5 · Notify and remediate
Objective: Meet obligations and restore affected people, records, and decisions fairly and consistently. Lead: Legal/compliance and business
P6 · Recover and validate
Objective: Return to service only after evidence shows the risk is controlled and the operating design is supportable. Lead: System owner and independent control
P7 · Close and learn
Objective: Close only when remediation, evidence, ownership, and systemic improvement are complete. Lead: Accountable executive

Decision and evidence log

No entries yet. Add decisions, evidence, communications, and changes as they occur.

Severity guide

SEV-1 · CriticalActivate immediately

Actual or imminent widespread consumer harm, unlawful or unsafe automated action, material financial exposure, active data compromise, loss of control over an agent, or a regulator-notifiable event requiring urgent executive direction.

SEV-2 · HighActivate within 1 hour

Material but containable impact, credible adverse consumer outcome, significant model or workflow failure, repeated unauthorized action, or an incident likely to require legal, compliance, regulator, or executive involvement.

SEV-3 · ModerateActivate same business day

Limited impact with effective containment, no known material rights impact, and a credible path to correction through established operational controls.

SEV-4 · Low / Near missLog within 1 business day

No confirmed harmful outcome; issue was prevented, detected in testing, or remained within low-impact internal activity. Track for patterns and control improvement.

Foundations: NIST SP 800-61 Rev. 3 · NIST AI RMF · NAIC Model Bulletin