You Have a Breach Plan. Do You Have an AI-Failure Plan?

Ask any mature organization what happens in the first hour of a data breach and you will get a crisp answer: a named incident commander, a runbook, a communications plan, a legal escalation path. Years of muscle memory.

Now ask what happens when an AI system fails publicly — gives a patient or customer dangerously wrong information, makes a discriminatory decision, leaks data through an automated process, or generates content that ends up in front of a journalist. In most organizations, the honest answer is: nobody knows. No commander, no runbook, no clock.

That is the gap. We built incident response for breaches because breaches felt inevitable. AI failures are now equally inevitable — and the difference between a contained incident and a reputational crisis is almost entirely whether you decided who does what before it happened. For healthcare organizations, where an AI failure can touch patient safety and protected health information at the same time, the plan is not optional.

The number that matters

80% of organizations have already experienced risky AI behavior — unauthorized data exposure or improper system access. The failures are already happening. The only variable left is whether you have rehearsed the response.

Draft a one-page AI incident plan this week

Keep it to a single page on purpose — a plan no one can read in a crisis is not a plan. Five fields:

• Trigger — what counts as an AI incident worth activating this for.
• Commander — the one named person who runs it.
• Containment — the first action (often: take the system offline, or to human-only).
• Log — what gets captured, by whom, before anything is changed.
• Notify — who gets told, in what order: legal, leadership, affected patients or customers, regulator.

Then run one tabletop exercise against a plausible scenario. The first time you run the plan should not be the first time it is real.

How LANStatus helps

Monitoring and incident response are at the center of managed IT — it is what our clients already rely on us for when systems go down. We extend that same discipline to AI: helping you define what “failure” looks like for each system, build the one-page plan, wire in the monitoring that catches it early, and run the tabletop so your team has muscle memory before the real thing.

If your most customer-facing AI system failed badly at 9am tomorrow, how long until the right person knew — and would they know what to do?