First 30 Minutes After a Suspected AI-Use Incident

When AI use creates a data, client-trust, or operations problem, the first job is to preserve facts and establish ownership before the response becomes improvised.

0–5 minutes — Stop the spread

Pause the affected AI-assisted activity.
Preserve the original prompt, output, files, screenshots, and timestamps.
Do not delete evidence or rewrite the incident history.
Assign one incident owner.

5–10 minutes — Identify what happened

Which AI tool was used, and by whom?
What information entered the tool?
What output was produced?
Was the output shared, published, relied upon, or sent to a client?
Is the issue still active?

10–20 minutes — Assess immediate impact

Was sensitive company, personal, or client information involved?
Was the output harmful, false, biased, unsafe, or unauthorized?
Is there financial, operational, contractual, or reputational impact?
Does related work or access need to pause?

20–30 minutes — Create the response record

Start one factual incident log.
Record the current owner and decision makers.
List open questions and missing facts.
Assess client impact before external communication.
Route legal, privacy, insurance, regulatory, and cybersecurity questions to qualified professionals.

Do not improvise external communication

Separate confirmed facts from assumptions before sending a client, vendor, public, or regulatory message.

See the complete seven-tool Desk Kit — $147 one time

The Desk Kit is an operational template system. It is not legal, privacy, insurance, regulatory, or cybersecurity advice.