Authority before access
Name the customer incident lead and the people authorised to approve changes, evidence collection and restoration. Provider terms and third-party permissions can affect what work is possible.
Evidence and confidentiality
Agree handling, transfer, storage, access and deletion for prompts, retrieved content, identity records and tool traces. Use the minimum necessary evidence and preserve a record of collection and transformations.
Reporting and notification decisions
The customer’s legal and privacy teams assess applicable contractual and statutory obligations using the established facts. An AI-related event does not have one universal reporting deadline. Response work should support timely decisions with clear evidence and uncertainty.
Minimum engagement readiness
- An identified organisation and incident owner.
- Authority to discuss the relevant systems and approve work.
- A route to the owners of identities, applications and records.
- Agreed confidential handling and access scope.
- A decision process for containment, scope changes and recovery.
Supplier records may determine the investigation limit
Some evidence is retained by a model, cloud or SaaS provider rather than in your application. Establish what the customer can export and what requires a provider support request. Record the retention deadline and request owner. A gap in provider access should be disclosed in the findings, not hidden behind a complete-looking timeline.
