Phase 5: AI Impact Assessment & Governance · 40 min · Python

AI Incident Response — When Models Fail in Production

Every model will fail. The question is whether you detect it, document it, and learn from it.

Hiring signal: AI incident response is an emerging requirement in RAI roles. Being able to build an incident response playbook with detection triggers, severity classification, and reporting obligations shows operational maturity.

What you will learn

Describe the AI incident response lifecycle: detect → classify → contain → investigate → report → learn
Build an incident response playbook with severity levels and reporting timelines
Map incident reporting obligations to EU AI Act Article 73 and NIST AI RMF MANAGE 4.1
Create a post-incident review template

The Problem

In 2020, a credit scoring model at a major bank started denying applications from an entire zip code. The cause: a data pipeline change had silently corrupted the income field for that region. The model had been running for 3 weeks before anyone noticed — during which time, hundreds of applicants were wrongly denied credit.

The problem wasn't the model. It was the absence of an incident response process: no detection alerting, no severity classification, no containment procedure, and no reporting mechanism. The bank had a risk register (the risk was identified) but no operational playbook for when it actually happened.

The AI Incident Response Lifecycle

detect → classify → contain → investigate → report → learn
  ↑                                                        |
  └────────────────────────────────────────────────────────┘
                     (update risk register)

Stage	What Happens	Timeframe
Detect	Monitoring triggers an alert (bias drift, performance drop, data anomaly)	Automated, real-time
Classify	Determine severity level and assign incident lead	Within 1 hour
Contain	Stop the bleeding — roll back to previous model, disable automated decisions, switch to manual review	Within 4 hours
Investigate	Root cause analysis — what went wrong, why, and how widespread	Within 48 hours
Report	Notify stakeholders, regulators (if required), and affected individuals	Within 72 hours (GDPR)
Learn	Post-incident review, update risk register, improve monitoring	Within 2 weeks

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Severity Classification, Building the Incident Response Playbook, What's Next — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.