Incident Response & Vendor Due Diligence

Even with good controls, incidents happen: a tool receives sensitive data, an output contains hallucinated citations, or an AI-generated draft is shared too broadly. The solution is a pre-planned response and better vendor vetting.

AI incident response: 7 steps

1. Stop the spread: pause use; prevent further sharing.
2. Preserve evidence: save prompts/outputs, timestamps, users, and tool settings.
3. Assess scope: what data was involved, where did it go, who saw it?
4. Escalate: notify the supervising attorney and the designated incident owner (risk/IT).
5. Correct the record: if something was filed or sent, fix it quickly and transparently.
6. Notify as required: clients, courts, insurers, or regulators if applicable.
7. Improve controls: update policy, training, tool configuration, and checklists.

Vendor due diligence checklist (AI tools)

• Data use: Does the vendor train on your data? Can you disable training?
• Retention: How long are prompts/outputs stored? Can you configure retention?
• Security: Encryption in transit/at rest, access controls, audit logs, SOC2/ISO posture
• Subprocessors: Who else processes the data? Where are they located?
• Incident terms: Notification timelines and cooperation obligations
• Data export/deletion: Can you export logs and delete data on request?
• Model transparency: Versioning, known limitations, and change notifications

Red flags

• Vague language about data use (“may use to improve services” with no controls)
• No admin controls for retention, logging, or access
• No clear incident notification obligations

Practice tip: If you cannot explain where the data goes, you cannot defend confidentiality safeguards.