AAISM · Topic 7
AI Incident Response
Domain: AI Governance and Program Management, about 31% of the exam
The AI incident lifecycle
- Prepare
- Detect
- Classify severity
- Contain
- Investigate
- Eradicate
- Recover
- Disclose
- Learn
- First responder
- follow procedure, document, escalate
- First decision
- severity, isolate or fallback now
- Containment
- pull traffic, disable endpoints, fallback
- Eradication
- remove poisoned data, retrain, patch
- Recovery
- restore validated version, monitor closely
- Lessons
- update playbooks, controls, training
Classify severity before touching anything; the severity decides whether you isolate, fall back or watch
AI incident taxonomy
- Poisoning
- training data or model corrupted
- Evasion
- adversarial inputs bypass the model
- Extraction
- model or data stolen via queries
- Injection
- prompts hijack behavior or tools
- Leakage
- sensitive data in outputs
- Bias event
- discriminatory outcomes discovered
- Drift failure
- silent performance decay
- Misuse
- system used for harm
Why AI incidents differ
- Harm without any code change
- Root cause may be data months old
- Nondeterministic outputs hinder reproduction
- Third-party models hide internals
- Bias incidents carry legal exposure
- Model versions, not patches, fix it
- Explainability needed to prove cause
Detection signals
- Prediction drift and confidence shifts
- Data drift against training baseline
- Anomalous prompt patterns and volumes
- Guardrail trigger spikes
- Fairness metrics sliding by group
- User complaints and appeals rising
- Unauthorized model versions serving
Severity matrix dimensions
- Safety
- physical or psychological harm
- Data sensitivity
- personal, regulated, secret
- Scope
- users, systems, regions affected
- Regulatory trigger
- reporting clock starts
- Reputation
- public visibility of failure
- Reversibility
- can decisions be undone
Containment and rollback
Kill switch
- Pull model from traffic instantly
- Disable tools and plugins
- Route to human review or rules
- Tested regularly, not assumed
Rollback
- Automated beats manual under pressure
- Keep two prior versions, not one
- Hot standby loaded, cold needs time
- Pipelines and schemas must match
- Stateful systems lose context on rollback
Bias interim fixes
- Human review for affected group
- Disable the specific feature
- Communicate to affected users
- Scope the impact before permanent fix
Forensics for models
- Preserve model version, weights, config
- Capture prompts, outputs, timestamps, versions
- Compare checkpoints to find divergence
- Trace training data lineage backwards
- Reconstruct attacker query sequences
- Chain of custody for artifacts
- Explainability tools locate the cause
Logging for investigation
- Every decision logged in regulated sectors
- Model version and confidence recorded
- Prompts redacted unless legally required
- Feature importance where available
- Tamper-evident, access controlled
- Retention matched to reporting duties
Disclosure obligations
- EU AI Act serious incident
- provider reports to market surveillance
- Serious means
- death, health, infrastructure, rights
- Deployer duty
- suspend, inform provider and authority
- GDPR breach
- 72 hours to supervisory authority
- Sector rules
- finance, health timelines apply
- Contracts
- vendor and customer notification clauses
Preparation
- Playbooks for top risk scenarios
- Tabletop exercises with AI cases
- Vendor contacts and escalation paths
- External specialists lined up early
- Insurance verified to cover AI events
- Psychological safety for bias reports
- Model cards ready for responders
Third-party model incidents
- Limited visibility into model internals
- Vendor owns root cause analysis
- Contract sets notification timelines
- Fallback to alternative provider
- Preserve your own logs regardless
- Coordinate disclosure with the vendor
Key terms
- Kill switch
- instant removal from traffic
- Hot standby
- loaded, serves immediately
- Cold standby
- must load before serving
- Checkpoint
- saved model state snapshot
- Prediction drift
- output distribution shifting
- Model forensics
- root cause of model failure
- Serious incident
- AI Act reportable event
Reference strip: detect, classify, contain, investigate, disclose
Detect
- Drift, anomalies, guardrail spikes
- Complaints are signals too
- Automate alerts, humans triage
- Baseline against training data
Classify
- Severity matrix first
- Safety, data, scope, regulation
- Decides isolate versus fallback
- Reversibility raises urgency
Contain
- Kill switch, fallback, human review
- Automated rollback, two versions
- Check pipeline compatibility
- Disable specific features for bias
Investigate
- Preserve weights, prompts, outputs
- Trace lineage and checkpoints
- Chain of custody kept
- Explainability finds the cause
Disclose and learn
- AI Act serious incident reports
- GDPR 72-hour clock
- Vendor and customer clauses
- Update playbooks and controls
Quick exam traps
- Trap: Rolling back to the immediately previous version always removes the problem
- Trap: AI incidents follow the standard IT playbook without changes
- Trap: Manual rollback is safer than automated rollback
- Trap: A bias finding is a quality issue, not a security incident
- Trap: Only the provider has duties when a high-risk system causes a serious incident
- Trap: Logging full prompts is required for every AI system
- Trap: Hot and cold standby give the same recovery time
- Trap: With a third-party model, incident response is entirely the vendor's job
cybercertprep.com · original revision sheet written from the public body of knowledge