PreviewYou're previewing CLO AI Chambers. Sign in to use it.Sign in
← All lessons
L4 · Legal oversight of company AI8 min read

AI incident response: legal's playbook

AI incidents are different from ordinary IT incidents. They include harmful or wrong output (a chatbot giving false information), data leakage through prompts or outputs, biased or unlawful decisions, IP complaints about generated content, and misuse of the company's AI by others.

Legal's questions in the first 48 hours

  1. What happened, to whom, and is it still happening? Can the AI be paused or rolled back?
  2. Privilege: should the investigation be run at the direction of counsel? Who is in the privileged group?
  3. Notification: do data protection, sector, contractual or AI-law duties require notice to regulators, customers or individuals, and by when?
  4. Preservation: preserve prompts, outputs, model versions, logs and configuration.
  5. Contracts: which vendor is involved, what do the contracts say about cooperation, indemnity and audit?
  6. Communications: what do we say, and who says it?

Prepare before it happens

  • Add an AI annex to the incident response plan, with legal's role defined.
  • Make sure AI systems log enough to investigate.
  • Run a tabletop exercise with security, the AI owner and communications.
  • Keep a register of AI incidents and near-misses, and feed lessons into the policy and contracts.

Bias incidents

AI used in decisions about people can breach anti-discrimination law even if nobody intended it. Regular testing and a human-review path are both prevention and evidence.

What this means for the General Counsel

What this means for a General Counsel

You will be in the room for every serious AI incident. Decide now: who leads, when counsel directs the investigation, what is preserved and who decides on notification.

Ask the CISO to include an AI scenario in the next incident tabletop (the AI CSO Hub has ready-made exercises), and make sure your AI vendor contracts give you the cooperation and logs you will need.

After each incident or near-miss, ask what should change in the policy, the contracts and the training, and record it. Regulators and courts look favourably on organizations that can show they learned and adapted.

Real example

In August 2023 iTutorGroup agreed to pay $365,000 to settle a lawsuit brought by the U.S. Equal Employment Opportunity Commission, which alleged that the company's application software automatically rejected female applicants aged 55 or older and male applicants aged 60 or older. It was described as the EEOC's first settlement in a case involving AI-driven hiring discrimination. Source: Norton Rose Fulbright — US EEOC's first settlement in AI hiring discrimination (iTutorGroup, 2023) ↗

Use it

Quick check · 3 questions

  1. 1.What should be preserved early in an AI incident?

  2. 2.Why consider running an AI incident investigation at the direction of counsel?

  3. 3.What did the iTutorGroup settlement illustrate?

0 of 3 answered

Sources

Last reviewed 2026-10-01.