Incident Response & Vendor Due Diligence

Even with good controls, incidents happen: a staff member pastes sensitive text into the wrong tool, or an AI output contains harmful errors. What matters is how quickly you respond and how well you document.

Incident response quick flow

{{UPLOAD_ASSET:incident_response_flowchart.png}}

Vendor due diligence (minimum questions)

• Is the tool approved for client data? (If not, stop.)
• Where is data stored, and for how long?
• Is data used to train models? If yes, can we opt out?
• What encryption and access controls exist?
• Do we get audit logs?
• What happens if there is a breach?

Common incident types

• Data exposure: sensitive text pasted into a public tool.
• Bad authority: hallucinated cases or statutes used in a draft.
• Bias: discriminatory or unfair language in output.
• Misleading communication: client-facing text implies certainty without support.

Activity: tabletop exercise

Run a 10‑minute tabletop exercise with your team:

1. Assume a user pasted privileged content into an unapproved AI tool.
2. List the first 5 actions you will take in 30 minutes.
3. Decide who must be notified (supervisor, IT, privacy, client?).