{"data":{"slug":"ai-incident-response-playbook","title":"AI Incident Response Playbook and Log","type":"procedure","formats":["docx","xlsx"],"topics":["incidents","governance","evidence"],"frameworks":["eu-ai-act","nist-ai-rmf"],"short":"Detect, contain, report and learn: a playbook built from the recorded incident-handling duties, with the reporting deadlines they set, and a log that computes them.","covers":{"categories":["incident_handling","post_market_monitoring"]},"version":4,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:17+00:00","citations":252,"downloads":7,"files":[{"format":"docx","filename":"ai-incident-response-playbook-v4.docx","bytes":13661,"url":"https://aipolicytracker.org/templates/ai-incident-response-playbook#download"},{"format":"xlsx","filename":"ai-incident-response-playbook-v4.xlsx","bytes":56848,"url":"https://aipolicytracker.org/templates/ai-incident-response-playbook#download"}],"url":"https://aipolicytracker.org/templates/ai-incident-response-playbook","inside":["Document: severity scale, roles, the playbook steps, the reporting duties on record with their deadlines","Incident log sheet: severity and harm-domain dropdowns, deadline computed from the date, status","Regulators sheet: who to notify, by jurisdiction, from the records"],"legal_basis":["eu-ai-act","us-nist-ai-rmf"],"caveat":null,"covered_obligations":[{"slug":"us-california-sb-53-critical-safety-incident-reporting","title":"Report critical safety incidents to the Office of Emergency Services","policy":"us-california-sb-53","source_reference":"Business and Professions Code, Chapter 25.1 (as added by SB 53)","url":"https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","policy":"eu-ai-act","source_reference":"Article 72","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","policy":"eu-ai-act","source_reference":"Article 73","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting"},{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","policy":"eu-ai-act","source_reference":"Article 20","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information"},{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","policy":"eu-ai-act","source_reference":"Article 26(5)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension"},{"slug":"eu-ai-act-art-55-systemic-risk-incident-reporting","title":"Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office","policy":"eu-ai-act","source_reference":"Article 55(1)(c)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting"},{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","policy":"india-dpdp-act","source_reference":"Section 8(5) and 8(6); DPDP Rules on breach intimation","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification"}],"versions":[{"version":4,"generated_at":"2026-11-12T05:14:17+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 52bd836b1d6b → ef1018b7a6a2.","stats":{"sheets":{"Incident log":0,"Regulators":238,"Incident duties":7},"blocks":57,"headings":15,"citations":252}},{"version":3,"generated_at":"2026-10-08T05:30:01+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 3335c39da4b7 → 52bd836b1d6b.","stats":{"sheets":{"Incident log":0,"Regulators":238,"Incident duties":7},"blocks":57,"headings":15,"citations":252}},{"version":2,"generated_at":"2026-09-27T05:30:01+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7. Sheet \"Incident duties\": 9 → 7 rows (-2). Document: 69 → 57 blocks. Record citations: 256 → 252.","stats":{"sheets":{"Incident log":0,"Regulators":238,"Incident duties":7},"blocks":57,"headings":15,"citations":252}},{"version":1,"generated_at":"2026-09-26T13:04:58+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"Incident log":0,"Regulators":238,"Incident duties":9},"blocks":69,"headings":17,"citations":256}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}