Incident disclosure: what to publish when an AI fails publicly

Three ways to see it

1. 1

   An AI incident is any event where the system produced an output, took an action, or made a decision that caused or could have caused harm. Harm includes financial loss, denial of a service or right, exposure of private data, dignitary harm to an individual or community, regulatory violation, or reputational harm to the operator. The bar is intentionally low. If your team is asking 'is this an incident', it is an incident. The cost of over-recording is small. The cost of under-recording is the next public crisis you face without preparation.

2. 2

   A disclosure has internal and external layers. Internal: a triage record opened within an hour, with timeline, scope, evidence, lead, and severity. External: a public note when the incident affects users, citizens, or regulators. Externally the standard structure is six sections. (1) What happened, in plain language. (2) Who was affected and how many. (3) What we have already done. (4) What we are still doing and by when. (5) How users can check if they were affected and what they can do. (6) What we will publish next and on what date. Six sections, ideally under 800 words, in both Urdu and English for any Pakistani public-facing system.

3. 3

   Timeline discipline matters more than perfect content. The industry baseline that has emerged after the EU AI Act and US Executive Order 14110 is: triage within one hour, internal containment within 24 hours, public acknowledgement within 72 hours of confirmed user impact, full public disclosure within 7 days, post-mortem and remediation plan within 30 days. Pakistani buyers should write these timelines into vendor contracts as the default. Vendors who push back on the 72-hour public acknowledgement should be asked to justify the longer wait in writing. The justification almost never survives examination.

The why-tree

Try this with Claude

Capstone challenge — three actions. (1) Draft a blank incident disclosure template in your team's language and store it where on-call staff can find it at 2 am. (2) Run a tabletop exercise this month: pick a hypothetical incident, time how long it takes you to reach a 72-hour-ready public note. (3) Identify the named bilingual writer who will sign the next public disclosure; if no name, the role is missing.