A.9.1 AI Incident Response: Build Your AI Risk Management Process

What this means

Your organization must create and regularly test a documented process for responding to AI-related incidents. This includes defining incident triggers (unexpected model behavior, data poisoning, unauthorized access, performance degradation), establishing who reports incidents and to whom, documenting investigation steps, defining containment actions to prevent spread, implementing remediation to resolve root causes, and capturing lessons learned to improve your AI governance framework over time.

How to comply

1. 1.Define and document what constitutes an AI incident for your organization (e.g., model accuracy drops >5%, security breach, data drift, unauthorized model changes, third-party integration failure)
2. 2.Establish clear reporting channels and escalation paths so teams know exactly who to notify and when (e.g., AI team, security, executive sponsor)
3. 3.Create a standardized investigation template that captures incident source, affected systems, scope, timeline, and root cause analysis
4. 4.Define containment actions (pause model, revert to previous version, isolate affected data, restrict access) for different incident severity levels
5. 5.Document remediation steps and assign owners responsible for resolution and verification
6. 6.Implement a lessons-learned process that feeds findings back into AI governance, model monitoring, and training programs
7. 7.Test the entire incident response process annually through tabletop exercises or simulated incidents
8. 8.Maintain an incident log with metadata for trend analysis and compliance audits

Evidence auditors look for

• Documented AI Incident Response Plan with incident classification, reporting procedures, escalation matrix, and investigation workflow
• Incident reporting form or ticketing system configured to capture AI incident data automatically
• Investigation templates showing root cause analysis, containment measures, and remediation tracking
• Incident response test results (tabletop exercises, simulation reports) with dates and participant feedback
• Lessons-learned documentation showing how past incidents drove changes to model governance, monitoring, or training
• Incident log with timestamped records including incident type, discovery date, resolution date, and impact assessment
• Communication templates for internal and external incident notification
• Training records showing team members understand the incident response process

Frequently asked questions

GRCWatch automates AI incident tracking and response workflows, letting your team log incidents, escalate automatically based on severity rules, document investigations, and track remediation—all within a single compliance-ready platform that feeds lessons learned directly into your ISO 42001 governance records.

See how GRCWatch handles this control automatically

Related controls