AI Incident Report Template (.docx)
Download the AI Incident Report Template (.docx)
Purpose: Record one AI incident in a consistent way, so that containment, evidence, notifications and lessons are not lost, as AI-CTRL-035 asks.
Audience: Incident leads, SOC, AI product owners, data protection officers and legal.
Before you rely on it: Severity levels and response times come from the wiki's illustrative AI Operating Defaults. Notification deadlines are not set by this template: take each one from the law or contract that applies and record its source. This is not legal advice.
What is in the document
| Section | What it records | Built from |
|---|---|---|
| 1 to 2. Summary and what happened | ID, severity, type, systems and versions involved, description and impact in plain language | AI Operating Defaults |
| 3. Timeline | Every event and action with time, actor and evidence reference | D12 AI Incident Response and Forensics |
| 4. Response | Containment and who authorised it, preserved evidence, provider contact, escalation, and each notification with its legal or contractual source, clock start and deadline | TC-L03-019, TC-D12-016 |
| 5. Root cause | Model, data, prompt, tool, access, process, vendor and human factors | TC-D12-020 |
| 6 to 8. Impact, actions and closure | People, data, money, regulatory and reputational impact; actions with owners and verification; review and closure | AI Governance Operating Model |
For jurisdiction-specific notification workflows, see the incident templates in the regional sections, for example GCC T05, EU T05 and India IN-T2. Their legal citations carry the verification tags of their sections.
From the Builder Track
The Builder Track's kill switch and audit log produce the timeline and containment facts this report asks for.
Licence and credit
The document is licensed under CC BY-SA 4.0, like the rest of the wiki. Suggested credit: "AI Incident Report" by Nachiket Sathaye and Ankush Jain, AI Security Wiki, licensed under CC BY-SA 4.0. If you share an adapted version, say what you changed and release it under the same licence.