Policy · AI decision systems
AI incident response procedure for law firms (master procedure for all AI incidents)
Master procedure for detecting, containing, assessing and remedying every kind of AI incident: fabricated citations reaching a court, client data in unapproved tools, harmful outputs from client-facing tools, biased decisions, deepfake impersonation and vendor breaches.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- Australia, New South Wales, Victoria, Western Australia
- AI use
- Red Keep AI out of the decisive steps. A lawyer does the work.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Adopt with the firm AI use policy and alongside the data breach response plan, which still governs data breaches. Use it whenever an AI-related error, exposure or misuse is suspected, even if no harm is yet known.
How AI may be used
Lawyer-led. AI may help build a timeline from logs and list affected matters, but decisions about containment, notification to courts, clients, the OAIC and insurers are made by the incident lead and responsible partners.
AI may
- Build a timeline of events from system logs, tool histories and emails for the incident lead to verify.
- List the matters, clients and documents potentially affected from search results the lawyer specifies.
- Draft internal status updates from the incident lead's notes.
AI must not
- Must not decide whether a breach is notifiable or whether a court must be told.
- Must not draft communications to a court, client, regulator or insurer without lawyer review.
- Must not be given the incident materials in the tool that caused the incident.
The lawyer checks
- Evidence is preserved before any remediation that would alter it.
- Court corrections are made as soon as possible and recorded.
- Notification decisions under Pt IIIC and the insurance policy are made and documented within the time limits.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in AI decision systems
- Law firm AI use policy (master firm policy)
- Approved AI tools register (template with field guide)
- AI vendor due-diligence questionnaire for law firms (master version)
- AI decision system impact and fairness assessment (firm or client systems)
- Privacy policy clause on automated decisions (APP 1.7 to 1.9, from 10 December 2026)
All precedents for AI decision systems · Tasks and AI use in this area