Prepare an incident-response checklist for an AI system
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the contract’s notice clause and the system description, list who must be told, the trigger the contract uses, and the clock the contract states. Leave the notice itself blank.
- What the lawyer must review
- SEC Press Release 2023-139: an Item 1.05 Form 8-K is generally due four business days after the registrant determines a cybersecurity incident is material, and the disclosure may be delayed if the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. The clock runs from the materiality determination. Cal. Civ. Code § 1798.82 requires a disclosure, when that section applies, within 30 calendar days of discovery or notification of the breach, titled “Notice of Data Breach,” under the headings the statute names. The lawyer decides materiality and writes any notice. Formal Opinion 512: do not put incident facts into a tool that is not configured to keep them confidential.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm instructions and personal circumstances through appropriate direct engagement. Have the responsible lawyer assess safety, capacity or vulnerability concerns and escalation.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Security incident clause | Clause | AI use Yellow | Contract clause that makes a vendor who holds computerized personal information notify the customer immediately, using the California statute's maintainer rule. |
Signed-in accounts can read the full text of each one. All precedents.