A company discovered their hiring AI had been producing biased results for four months.
A customer caught it, not the internal team. By the time leadership found out, hundreds of candidates had already been affected.
The question they couldn’t answer wasn’t what went wrong. It was what to do in the next 24 hours.
That’s the question almost every company is unprepared for.
Why AI Failures Are Different From Other Crises
When a data breach happens, companies follow a playbook. Notify affected parties, engage legal, communicate with regulators, issue public statements. The steps are well-established because companies have been dealing with data breaches for decades.
AI failures don’t have that playbook yet.
When AI makes discriminatory decisions at scale, when it hallucinates information that affects customers, when it makes unauthorized commitments or produces harmful outputs, the response requirements are different from any crisis type companies have handled before.
The harm can be widespread before anyone notices because AI operates at scale without the natural friction that slows down human errors. By the time a problem surfaces, it may have affected thousands of people over months.
The regulatory notification requirements vary by what the AI did, who was affected, and which jurisdictions are involved. The legal exposure depends on documentation that may or may not exist. The public communication challenge involves explaining AI failures to audiences who don’t understand how AI works.
Companies that haven’t thought through these questions before a crisis hits end up making decisions under pressure that make everything worse.
What an AI Incident Response Plan Actually Covers
An AI incident response plan answers four questions before the incident happens.
The first is who gets notified and how fast. When an AI failure is discovered, there’s usually a gap between when someone identifies the problem and when the people who need to know find out. That gap is where bad decisions get made. The plan needs to define who gets notified immediately, what information they need, and how the notification happens so it doesn’t depend on whoever happens to be available at the time.
The second is who has authority to shut the AI down. This sounds obvious until a crisis happens and it becomes clear that nobody has clear authority to stop an AI system that’s causing harm. Engineering thinks legal needs to approve it. Legal thinks engineering needs to assess the business impact first. The AI keeps running while everyone figures out the process.
The third is what regulators need to know and when. Different AI failures trigger different regulatory notification requirements. EEOC violations from biased hiring AI, privacy violations from AI processing personal data improperly, consumer protection issues from AI giving wrong information to customers – each has different notification timelines and requirements. Companies that figure this out during the crisis consistently miss deadlines that were avoidable.
The fourth is how to protect people who were already affected. Once an AI failure is discovered, there are usually people who made decisions or were affected by decisions based on what the AI produced. What does the company owe them? How do they get notified? What remediation is appropriate? Having answers to these questions before a crisis means the response focuses on doing right by affected people rather than on figuring out the minimum required.
The Documentation Problem
AI incident response depends on documentation that most companies don’t have.
To respond effectively to an AI failure, companies need to know what the AI was doing, what data it was using, what decisions it was making, who was affected, and when the problem started. Without documentation of how the AI operates, answering these questions requires investigation that takes time the response timeline doesn’t allow.
Regulators and plaintiffs will also want this documentation. Companies that can produce clear records of what their AI was doing, when they discovered the problem, and what they did in response are in a fundamentally different position than companies reconstructing everything after the fact.
Building documentation practices during AI deployment rather than during incident response is the difference between a manageable crisis and an uncontrollable one.
What the First 24 Hours Should Look Like
The first 24 hours of an AI crisis determine how manageable the next six months are.
Companies with incident response plans spend those hours on the right things: assessing scope, notifying stakeholders, engaging legal and communications, beginning remediation for affected people, and preparing regulatory notifications.
Companies without plans spend those hours figuring out who’s in charge, what actually happened, who needs to know, and what the legal requirements are. They’re still doing basic triage when they should already be in response mode.
After nearly 30 years watching companies navigate regulatory crises across telecom, fintech, and compliance, the pattern is consistent. The companies that handle crises well are prepared before they need to. The companies that struggle are the ones who assumed they’d figure it out when it happened.
With AI deployed at the scale and speed it’s being adopted right now, most companies will face an AI failure at some point. The question is whether they’ll have a plan when it happens.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor