Template Library
AI Incident Log and Response Playbook
An Excel workbook for AI incidents and near misses: a seven-step response playbook, severity levels, a contact list, a log with time to contain, root cause, and corrective actions, and a dashboard by severity, type, and cause.
The Playbook sheet sets out seven steps from detection to reporting, with who does what and when, four severity levels with examples and responses, and a contact list to fill in. The Incident Log records each incident or near miss with the time it was detected and contained, the type, the severity, what happened, the root cause, whether it was reported outside, and the corrective action with an owner, a due date, and a done flag. Hours to contain and an action check calculate.
The Dashboard shows incidents by severity, type, and root cause, the median hours to contain, open incidents, near misses, and overdue actions. Logging near misses, such as a wrong output that a reviewer caught, shows which controls work and what the AI gets wrong.
Eight example incidents at an illustrative plant, including an agent that sent duplicate orders and a drift after a vendor change, are included so you can see the formulas working before you replace them.
Download AI Incident Log and Response Playbook Back to Templates
What Is Included in the Workbook
| Sheet | Purpose | What Teams Capture |
|---|---|---|
| Start Here | Orientation and workflow | What the workbook does and a numbered workflow with a link to the sheet for each step |
| Dashboard | Live summary of incidents | Incidents logged, still open, severity S1 or S2, median hours to contain, actions overdue, near misses, and counts by severity, type, and root cause with a chart |
| Playbook | Response steps, severity levels, and contacts | Seven steps with who and when, four severity levels with examples and responses, and a contact list by role |
| Incident Log | The incident log (Excel Table) | ID, detected and contained times, detected by, AI use, type, severity, what happened, hours to contain, root cause, status, reported outside, corrective action, owner, due date, done, and a calculated action check |
| Settings | As-of date and lists | The as-of date and the lists for type, severity, root cause, status, and yes, no, or not applicable |
Key Features Inside the Template
A Playbook Ready Before It Is Needed
Seven steps, four severity levels, and a contact list to complete in advance.
Time to Contain
Hours from detection to containment calculate for every incident.
Patterns by Type and Cause
See whether the same cause keeps returning, and fix the system.
Near Misses Count
Log the wrong outputs that reviewers caught, as evidence that controls work.
Best Use Cases
- Setting up incident handling before an AI launch
- Logging incidents and near misses for one AI use or the whole portfolio
- Running blameless postmortems and tracking the actions
- Showing a governance group or auditor how incidents are handled
- Teaching incident response for AI
How to Use the Template Effectively
- Complete the contact list and agree the severity levels and times on the Playbook sheet.
- Check the incident types and root-cause categories on the Settings sheet.
- Log each incident or near miss with the times, type, severity, what happened, and the root cause.
- Give every corrective action an owner and a date, and mark it done when it is finished.
- Hold a blameless postmortem for S1 to S3 incidents.
- Review the dashboard monthly and report it to the governance group.
Who Should Use This Template
- Use owners and process owners
- Security, IT, and risk teams
- AI governance groups
- Safety and quality leaders
Common Mistakes to Avoid
- No kill switch or manual fallback
- Not logging near misses
- Blaming people instead of finding what the system allowed
- Fixing the output but not the cause
- Leaving actions without owners or dates
Important Notes
AI Incident Log and Response Playbook Frequently Asked Questions
What counts as an AI incident?
A wrong output that reached a customer or record, data entered into an unapproved tool, an agent acting outside its limits, injected instructions that changed behavior, an unexplained change in results, or a concern about fairness. A near miss that a reviewer caught is worth logging.
Do I have to report AI incidents outside the company?
It depends on the sector, the data, the contracts, and the place. Ask your legal and compliance leads, and record the answers on the Playbook sheet.
Why is the dashboard figure the median, not the average?
A single long incident, such as a slow drift, can distort an average. The median shows the usual time to contain.
Is the log itself sensitive?
It can be. Entries may describe data exposures or security weaknesses, so control who can open the file.