# AI incident response runbook

> What to do in the first 10, 60, and 360 minutes when your AI system leaks, misbehaves, or is under attack. CC-BY.

What to do in the first 10, 60, and 360 minutes when your AI system leaks, misbehaves, or is under attack. CC-BY.

Full incident runbook for AI systems · seven incident types (prompt injection, data leak, hallucination emergency, rate-limit abuse, model swap, jailbreak, oracle manipulation), T+10/T+60/T+360 minute response windows, communications templates for GDPR breach notification.

## What the file contains

- 7 incident types with response flow
- T+10 / T+60 / T+360 minute action items
- NAIH 72-hour breach notification email template
- Stakeholder alerting escalation matrix
- Blameless post-mortem template

## What to take away

- 7 incident types with response flow
- T+10 / T+60 / T+360 minute action items
- NAIH 72-hour breach notification email template
- Stakeholder alerting escalation matrix
- Blameless post-mortem template

## Tags

template, Markdown, ai-security, incident-response, runbook, llm-security

## Read the full write-up

/resources/ai-incident-response-runbook.md

## Terms used in this piece

- https://dfieldsolutions.com/en/glossary/prompt-injection.md
- https://dfieldsolutions.com/en/glossary/gdpr.md
- https://dfieldsolutions.com/en/glossary/jailbreak.md
- https://dfieldsolutions.com/en/glossary/naih.md
- https://dfieldsolutions.com/en/glossary/oracle.md
- https://dfieldsolutions.com/en/glossary/hallucination.md

## We build this for clients

https://dfieldsolutions.com/en/services/cybersecurity

## More from the lab

- https://dfieldsolutions.com/en/lab/ai-security-checklist-2026.md — AI security checklist 2026 · for production LLM systems
- https://dfieldsolutions.com/en/lab/data-processing-agreement-template-hu.md — Data Processing Agreement (DPA) template · Hungarian market
- https://dfieldsolutions.com/en/lab/ai-act-readiness-self-check.md — EU AI Act readiness self-check 2026
- https://dfieldsolutions.com/en/lab/dora-resilience-testing-playbook.md — DORA operational resilience testing playbook

---

Source: https://dfieldsolutions.com/en/lab/ai-incident-response-runbook
DField Solutions — Torony köz 5-1.a, 2120 Dunakeszi, Hungary — +36 20 722 0002 — dezso@dfieldsolutions.com
Booking: see https://dfieldsolutions.com/en/contact