AI Incident Response Plan Template: The First-Hour Playbook for a 20-Person Team

A composite scenario assembled from documented cases: At 4:15 PM on a Friday inside a twenty-person outpatient clinic outside Framingham, Massachusetts, two staff knock on the practice manager's door within four minutes. First, an intake coordinator whispers, "I think I just pasted a client spreadsheet into free ChatGPT and clicked Share to email the table to myself." Next, the bookkeeper walks in pale: "I wired $48,000 at 3:50 PM after a quick video call with our managing partner, and the partner just texted from Logan Airport asking why a wire alert fired." The bank's wire desk closes at 5:00 PM. Searching "AI incident response plan" on Google returns vendor blogs and a 67-page Coalition for Secure AI (CoSAI) manual written for an enterprise Security Operations Center (Google US SERP, Oct 29, 2026; CoSAI). Nobody on staff holds a CISSP, and the outsourced IT firm bills $175 an hour with a four-hour callback SLA.

Missing that first hour carries steep costs. In IBM's 2025 Cost of a Data Breach study (n = 600 breached organizations, vendor-sponsored Ponemon research), 63% of breached firms lacked AI governance, 97% of AI-breached firms lacked proper access controls, and high shadow-AI use correlated with +$670,000 per breach (IBM, Jul 30, 2025; Help Net Security, Aug 4, 2025). In IBM's separate 2026 cohort (n = 602 breached organizations, a distinct sample), roughly seven in ten breached firms lacked AI governance policies, unapproved AI tools figured in 43% of security incidents, compromised APIs and plug-ins led AI breaches at 27%, and AI-enabled malicious breaches averaged $6.0 million (IBM, Jul 29, 2026; Help Net Security, Jul 30, 2026). The FBI also logged $893 million across 22,364 AI-tagged fraud complaints in 2025 (SecureWorld, Apr 9, 2026).

You leave with why SOC manuals fail small teams, three 60-minute tracks, no-blame unit economics, and The ed.cafe One-Page First-Hour AI Incident Playbook & No-Blame Self-Report Form to pair with your One-Page Small-Business AI Policy.

Why do 67-page enterprise AI incident frameworks fail a 20-person organization at 4:15 PM on Friday?

Enterprise AI incident frameworks fail 10-to-50 person businesses, clinics, schools, and nonprofits because those playbooks assume SIEM engineers, endpoint telemetry, and in-house counsel that small employers never carry on payroll. Facing a 5:00 PM wire cutoff, a 67-page binder creates paralysis.

Frameworks from NIST (SP 800-61r3: NIST) and OASIS-hosted CoSAI (AI Incident Response Framework V1.0, 67 pages on model weight poisoning and agentic telemetry: CoSAI) fit Fortune 500 security teams well. Handing that binder to a twenty-person clinic is like bolting an airport crash-rescue manual above a diner's deep fryer. While the cook flips past foam-tender radio codes to page thirty-four, grease flames reach the ceiling duct. A diner needs a two-line placard: pull the Ansul ring, then shut the gas valve.

Where that grease-fire analogy breaks is sensory detection. Smoke trips an alarm within seconds even if the cook runs out. Workplace AI mistakes emit zero smoke and zero router alerts. A spreadsheet pasted into a phone chatbot, a rogue plugin BCC'ing mail, or a fake citation inside a client report stays invisible unless staff speak up inside Hour 1.

Track 1 (Minutes 0 to 60): What do you do when an employee pastes or shares sensitive data in an AI tool?

When staff paste client data, health records, payroll sheets, or secrets into an unapproved AI tool, your first-hour sequence is logging exact row scope before deleting anything, disabling model training, revoking public share URLs, and rotating exposed keys. Panic-deleting the chat thread at Minute 2 destroys your legal scoping defense.

Breach statutes penalize missing scope proof. Under Massachusetts M.G.L. c. 93H (MA Law) and 201 CMR 17.00 (Mass.gov), exposing a resident's name plus a Social Security number, state ID, or financial account number requires notifying the Attorney General, OCABR, and affected individuals without unreasonable delay. Under HIPAA (45 CFR Part 164 Subpart D, 164.400 to 164.414), unsecured PHI leaks start a 60-calendar-day clock from discovery, and 164.414 places the burden of proof on the covered entity under 164.402 (HHS HIPAA). Wiping the chat before noting which twelve rows of a 4,200-patient file were pasted can force notice to all 4,200 patients.

Run Track 1 in three blocks:

1. Minutes 0 to 15 (Log Exact Scope First): Record timestamp, tool, email, plan tier (Free, Plus/Pro, or Team/Enterprise), and exact file and row range pasted. Rotate pasted passwords or API keys immediately.
2. Minutes 15 to 35 (Disable Training & Revoke Shared URLs): Turn off model training (Data Controls in ChatGPT), then open Shared Links and revoke every public URL. Researchers in July 2025 found over 4,500 shared ChatGPT chats indexed in Google Search and showed sidebar deletion alone does not revoke shared links unless deleted in Data Controls (Search Engine Journal, Jul 2025). Delete the thread after logging scope; see Can Your Employer See Your ChatGPT, Copilot, or Claude History?.
3. Minutes 35 to 60 (Check Contract Boundaries): Harmonic Security's Q3 2025 telemetry (vendor report, not peer-reviewed) found 26.4% of GenAI uploads held sensitive data, with 12% in personal free accounts among sensitive exposures (Business Wire, Nov 13, 2025). Pastes inside an enterprise zero-retention or HIPAA BAA tenant are usually internal coaching (Is Microsoft Copilot Safe for Confidential Work?; Case Managers Using AI for Case Notes). Consumer-account PII or PHI leaks require calling counsel and your cyber insurer within 24 hours.

Track 2 (Minutes 0 to 60): How do you contain a compromised AI connector, OAuth token, or uninvited meeting bot?

When an unvetted AI connector, Model Context Protocol (MCP) server, browser sidebar, or meeting bot links to company email, Drive, CRM, or calendars, Wi-Fi domain blocks fail. Cloud connectors run server-to-server via persistent OAuth tokens inside Microsoft Entra ID or Google Workspace until revoked.

Three 2025 incidents show why Hour 1 must sever cloud tokens and rotate keys:

• Stolen OAuth grants (Salesloft Drift, Sep 2025): Attackers used compromised Drift AI chat tokens to export Salesforce data across over 700 organizations (Help Net Security, Sep 2, 2025).
• Cross-tenant MCP bug (Asana, Jun 2025): A flaw in Asana's MCP feature briefly exposed data across roughly 1,000 customer tenants (BleepingComputer, Jun 2025).
• Malicious MCP BCC (postmark-mcp, Sep 2025): The first malicious MCP package on npm copied legitimate email features while silently BCC'ing every outbound email, reset link, and API token to an attacker (The Hacker News, Sep 2025).

Run Track 2 in three steps:

1. Minutes 0 to 15 (Revoke OAuth & Sessions): Open Google (myaccount.google.com/permissions) or Microsoft (myapps.microsoft.com / Entra Enterprise Applications), revoke the OAuth grant, sign out sessions, and remove the plugin or MCP server.
2. Minutes 15 to 40 (Rotate Keys & Audit Mail): Rotate touched API keys, check Exchange/Gmail forwarding rules and outbound BCC headers since install, and screen for indirect hijacks (Prompt Injection for Office Workers).
3. Minutes 40 to 60 (Purge Meeting Bot Audio): Kick uninvited bots (Otter.ai, Fireflies.ai, Read.ai), unlink calendar OAuth, and delete cloud audio on the host dashboard. Massachusetts M.G.L. c. 272 s. 99 requires all-party consent before recording speech ($100/day or $1,000 minimum civil damages: MA Law; Otter wiretap claims survived dismissal: Baird Holm, Aug 2026). See AI Notetakers in Meetings.

Track 3 (Minutes 0 to 60): How do you claw back a deepfake wire transfer or retract a fabricated AI report?

Track 3 governs external emergencies where cash or deliverables already left your building: deepfake wire fraud (Subtrack 3A) and fabricated AI reports or filings (Subtrack 3B).

Subtrack 3A: Deepfake Wire Fraud and the Financial Fraud Kill Chain

Compare two real cases. In early 2024, an Arup worker in Hong Kong wired HK$200 million (~US$25.5 million across fifteen transfers) after a deepfaked executive video call; days passed before reporting, and the cash vanished (CNN, Feb 4, 2024). In April 2025, a Singapore finance director wired US$499,000 after a deepfake Zoom call, yet HSBC and Singapore police froze all US$499,000 within three days because the bank acted rapidly (Mothership, Apr 7, 2025).

In the US, freezing an outbound wire inside the 24-to-72 hour window relies on the FBI IC3 Recovery Asset Team (RAT) and its Financial Fraud Kill Chain (FFKC) (FBI IC3):

1. Minutes 0 to 15 (Bank Wire Recall Desk): Call your bank's fraud hotline, request an immediate SWIFT camt.056 / Fedwire recall and beneficiary freeze, and sign their Hold Harmless / Letter of Indemnity inside Hour 1.
2. Minutes 15 to 40 (File at www.ic3.gov): Enter exact originating and beneficiary routing/SWIFT and account numbers plus timestamps at www.ic3.gov so FBI RAT analysts can freeze funds at the receiving bank before second-hop transfers clear.
3. Minutes 40 to 60 (FinCEN Code & Insurer): Give your bank's fraud officer SAR keyword FIN-2024-DEEPFAKEFRAUD from Treasury FinCEN Alert FIN-2024-Alert004 (Nov 13, 2024: FinCEN PDF), file a police report, call your insurer, and install The Callback Rule Script.

Subtrack 3B: Fabricated External Report, Filing, or Chatbot Promise

Damage compounds when outsiders spot fake citations first. In October 2025, Deloitte Australia repaid the final installment of an AU$440,000 government contract after an academic caught fabricated references and an invented court quote (The Register, Oct 6, 2025). Across 2,241 court rulings in Damien Charlotin's database by October 29, 2026 (Charlotin), fast self-correction routinely reduces sanctions. Within Hour 1: halt distribution, send a brief Hold & Corrected Erratum Notice before reliance, re-verify every source via Check Every Source in an AI-Assisted Report, and check E&O notice terms (noting Verisk's January 2026 AI exclusions CG 40 47, CG 40 48, CG 35 08: IIABA).

Why does punitive blame destroy the 60-minute recovery window, and what does the unit economics math look like?

Tracks 1, 2, and 3 only work if an employee tells you at Minute 5 instead of hiding the mistake until Day 30. Punitive handbooks destroy that window.

In KPMG's global survey (n > 48,000 workers), 57% of AI users hid their use and 56% made AI mistakes (KPMG, Apr 2025); in Slack's survey (n = 17,372 desk workers), 48% felt uncomfortable admitting AI use to managers (Salesforce/Slack, 2024). Threatening write-ups trains staff to delete logs and stay silent. Compare a 20-person firm's balance-sheet math:

The ed.cafe No-Blame First-Hour Self-Report Guarantee waives discipline for honest mistakes reported within 60 minutes with logs intact, carving out intentional malice, hiding evidence, or repeating a coached violation. Pair it with our 30-Day Shadow AI Amnesty Plan and Free 60-Minute DOL AI Literacy Session. In Massachusetts, No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312) is forming ed.cafe Boston Circle #1 at ed.cafe/start/, a free 30-chair cohort closing December 1, 2026 (pre-launch as of October 2026; zero cohorts completed yet), with templates in the Staff Room.

Copy-ready template: The one-page first-hour AI incident playbook and no-blame self-report form

Print The ed.cafe One-Page First-Hour AI Incident Playbook & No-Blame Self-Report Form, fill Part 4 before an incident, and post it at payroll, reception, and Slack.

THE ED.CAFE ONE-PAGE FIRST-HOUR AI INCIDENT PLAYBOOK & NO-BLAME SELF-REPORT FORM
For 10-to-50 Person Businesses, Clinics, Schools & Nonprofits | Publisher: ed.cafe

NO-BLAME FIRST-HOUR SELF-REPORT GUARANTEE
Staff who accidentally paste sensitive data into AI, link an unapproved app/bot,
send an unverified AI error, or act on an AI scam face ZERO discipline if reported
to the Incident Lead within 60 minutes of discovery with logs intact. Hiding an
incident, deleting logs, malice, or repeat coached violations void this guarantee.
Signed: ___________________________ (Owner / Director)   Date: __________________

PART 1: 5-LINE INTAKE CARD ("I Pasted / Sent Something I Shouldn't Have")
Walk or text to Lead [_______________________]:
1. WHAT & TIME: [ ] Data pasted  [ ] App/Bot linked  [ ] Wire/Login  [ ] Bad draft  at [____]
2. TOOL & TIER: Tool: _____________ | Email: _____________ | [ ] Free  [ ] Personal+  [ ] Work
3. EXACT SCOPE: File/rows pasted, app scopes, recipient, or wire $: ___________________________
4. SHARE / BOT: "Share Link" clicked or meeting bot active? [ ] No  [ ] Yes (LEAVE OPEN)
5. DONE SO FAR: (STOP: Keep chat history intact until Lead logs exact row scope!) _____________

PART 2: THREE-TRACK GOLDEN HOUR CHECKLIST (Minutes 0 to 60)
TRACK 1: SENSITIVE DATA PASTED OR SHARED (MA 201 CMR 17 / c. 93H; HIPAA 60-Day Clock)
[ ] Min 00-15 | LOG SCOPE FIRST: Record file, row count, data types (SSN, bank, PHI,
                keys), email, and tier (for HIPAA 45 CFR 164.402 & c. 93H). Rotate keys.
[ ] Min 15-35 | DISABLE TRAINING & REVOKE SHARE LINKS: Turn OFF training in Data
                Controls. Open "Shared Links" and REVOKE all public URLs (sidebar
                chat deletion alone does not kill shared links).
[ ] Min 35-60 | DELETE & ESCALATE: Delete thread after logging scope; request portal
                wipe if consumer tier. Call Counsel & Cyber Insurer <24h if PII/PHI.

TRACK 2: COMPROMISED CONNECTOR, OAUTH TOKEN, MCP PLUGIN, OR UNINVITED BOT
[ ] Min 00-15 | REVOKE OAUTH & SESSIONS: Revoke grants in Google (`myaccount.google.com/permissions`)
                or Microsoft (`myapps.microsoft.com` / Entra) and force-sign-out.
[ ] Min 15-40 | ROTATE KEYS & AUDIT MAIL: Rotate touched API keys; check Exchange or
                Gmail forwarding rules & outbound BCC headers since install date.
[ ] Min 40-60 | PURGE MEETING BOT: Kick bot (Otter/Fireflies/Read), unlink calendar
                OAuth, delete cloud audio on host dashboard (MA M.G.L. c. 272 s. 99).

TRACK 3: DEEPFAKE WIRE FRAUD OR FABRICATED EXTERNAL REPORT SENT
[ ] Min 00-15 | WIRE MOVED -> CALL BANK WIRE RECALL DESK NOW: Request SWIFT `camt.056`
                / Fedwire recall & freeze; sign Hold Harmless / Indemnity in Hour 1.
[ ] Min 15-40 | FILE `www.ic3.gov` (FBI `RAT` KILL CHAIN): Submit exact routing, SWIFT,
                account #s & timestamps (24-72h freeze window). Give bank officer
                FinCEN `FIN-2024-Alert004` SAR code: `FIN-2024-DEEPFAKEFRAUD`.
[ ] Min 00-45 | FABRICATED REPORT SENT -> HALT & ERRATUM: Stop sends, ask recipient
                to pause review pre-reliance, re-verify all sources, alert counsel/E&O.

PART 3: SEVERITY MATRIX (S1-S4)
- S1 CRITICAL (<15m; Owner + Bank/MSP + Counsel/Insurer): Wire/payroll fraud; live key
  leak; PII/PHI/Part 2 in consumer AI or share link; malicious OAuth/MCP; court filing.
- S2 HIGH (<60m; Ops + MSP/Counsel): Client data in consumer AI (no share link);
  unconsented external call recorded; retractable error in client deliverable.
- S3 MODERATE (Same day; Ops): Internal non-regulated memo in consumer AI.
- S4 LOW (Monthly log): Error caught inside approved zero-retention workspace.

PART 4: EMERGENCY CONTACTS (Complete Before Posting)
1. Incident Lead & Backup: ________________________ 4. Cyber/Crime/E&O 24/7 #: ________
2. Bank Wire Recall Desk (24/7): __________________ 5. Outsourced MSP Emergency #: ____
3. FBI IC3: https://www.ic3.gov (`FIN-2024-DEEPFAKEFRAUD`) 6. Counsel & Portals: ______

Where this stops being true

Four boundaries govern when an internal checklist yields to specialists:

• Minute 61 onward on regulated breaches belongs to counsel: Never send statutory breach notices without legal review under Massachusetts M.G.L. c. 93H / 201 CMR 17.00, HIPAA 45 CFR Part 164 Subpart D (60-day limit), 42 CFR Part 2, or FERPA.
• Insurer panel rules apply first: Call your cyber or crime carrier's 24/7 hotline before signing forensic retainers.
• Public-sector, defense, and union rules add duties: Union contracts govern amnesty; Massachusetts state contractors follow AI.001 v1.1 (Mass.gov PDF); defense contractors face 72-hour rules.
• Not legal or financial advice: Breach figures from IBM/Ponemon (n = 600; n = 602) and Harmonic are observational vendor studies, and wire freezes depend on bank speed.

Questions people ask

Key terms

• FBI IC3 Recovery Asset Team (RAT): The FBI unit triggered via www.ic3.gov to freeze fraudulent wires with banks within 24 to 72 hours.
• FinCEN FIN-2024-Alert004: Treasury's November 13, 2024 deepfake alert establishing SAR code FIN-2024-DEEPFAKEFRAUD.
• HIPAA 60-day breach clock (45 CFR Part 164 Subpart D): Federal rules requiring notice within 60 calendar days of discovering an unsecured PHI breach.
• Massachusetts 201 CMR 17.00 & M.G.L. c. 93H: State rules requiring Written Information Security Programs and breach notices for resident SSN, ID, or account leaks.
• Model Context Protocol (MCP) server: A connector standard letting AI access files, mail, or APIs that needs key rotation if compromised.
• No-Blame First-Hour Self-Report Guarantee: A signed pledge waiving discipline for accidental AI mistakes reported within 60 minutes with logs intact.
• OAuth access grant: A cloud permission token in Google Workspace or Microsoft Entra ID granting connected apps access until revoked.

Sources

1. Google US Audit, "AI incident response plan" (Oct 29, 2026): Google
2. CoSAI / OASIS, "AI Incident Response V1.0": CoSAI
3. NIST, "SP 800-61r3" (2025): NIST
4. IBM, "2025 Breach Report" (Jul 30, 2025, n = 600): IBM 2025
5. Help Net Security, "IBM 2025 Governance" (Aug 4, 2025, n = 600): HNS 2025
6. IBM, "2026 Breach Report" (Jul 29, 2026, n = 602): IBM 2026
7. Help Net Security, "IBM 2026 Unapproved AI" (Jul 30, 2026, n = 602): HNS 2026
8. SecureWorld, "FBI IC3 $893M AI Fraud" (Apr 9, 2026): SecureWorld
9. MA Legislature, "M.G.L. c. 93H": MA c. 93H
10. MA OCABR, "201 CMR 17.00": Mass.gov
11. US HHS, "HIPAA Breach Rule": HHS
12. Search Engine Journal, "Shared ChatGPT Links" (Jul 2025): SEJ
13. Business Wire / Harmonic, "GenAI Uploads" (Nov 13, 2025): Harmonic
14. Help Net Security, "Salesloft Drift Breach" (Sep 2, 2025): HNS
15. BleepingComputer, "Asana MCP Exposure" (Jun 2025): BleepingComputer
16. The Hacker News, "Malicious postmark-mcp" (Sep 2025): THN
17. MA Legislature, "M.G.L. c. 272 s. 99": MA c. 272
18. Baird Holm, "Notetaker Suit" (Aug 2026): Baird Holm
19. CNN, "Deepfake CFO $25M" (Feb 4, 2024): CNN
20. Mothership, "US$499K Wire Frozen" (Apr 7, 2025): Mothership
21. FBI IC3, "Recovery Asset Team": IC3
22. US FinCEN, "FIN-2024-Alert004" (Nov 13, 2024): FinCEN PDF
23. The Register, "Deloitte AU$440K Report" (Oct 6, 2025): The Register
24. Damien Charlotin, "Hallucinations Tracker" (Oct 29, 2026): Charlotin
25. IIABA, "Verisk AI Exclusions" (Jan 2026): IIABA
26. KPMG, "Trust in AI" (Apr 2025, n > 48,000): KPMG
27. Salesforce / Slack, "Workforce Index" (2024, n = 17,372): Salesforce
28. Mass.gov, "Policy AI.001 v1.1": Mass.gov PDF