---
title: "AI incident response procedure for law firms (master procedure for all AI incidents)"
url: "https://ailawframework.com/precedents/ai-decision-systems/ai-incident-response-procedure"
type: "precedent"
site: "AI Law Framework"
id: "a45-ai-incident-response-procedure"
area_id: "A45"
kind: "policy"
ai_level: "red"
version: 1
law_stated_as_at: "2026-10-17"
---

# AI incident response procedure for law firms (master procedure for all AI incidents)

> Master procedure for detecting, containing, assessing and remedying every kind of AI incident: fabricated citations reaching a court, client data in unapproved tools, harmful outputs from client-facing tools, biased…

Canonical page: https://ailawframework.com/precedents/ai-decision-systems/ai-incident-response-procedure  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

Master procedure for detecting, containing, assessing and remedying every kind of AI incident: fabricated citations reaching a court, client data in unapproved tools, harmful outputs from client-facing tools, biased decisions, deepfake impersonation and vendor breaches.

## Key facts

- Kind: Policy. A policy or procedure for a firm or client.
- Practice area: [AI decision systems](https://ailawframework.com/precedents/ai-decision-systems.md)
- Jurisdictions: Australia, New South Wales, Victoria, Western Australia
- AI level: Red. Keep AI out of the decisive steps. A lawyer does the work.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the 6 authorities it cites, for 4 jurisdictions.

## When to use it

Adopt with the firm AI use policy and alongside the data breach response plan, which still governs data breaches. Use it whenever an AI-related error, exposure or misuse is suspected, even if no harm is yet known.

## How AI may be used

Lawyer-led. AI may help build a timeline from logs and list affected matters, but decisions about containment, notification to courts, clients, the OAIC and insurers are made by the incident lead and responsible partners.

**AI may:**

- Build a timeline of events from system logs, tool histories and emails for the incident lead to verify.
- List the matters, clients and documents potentially affected from search results the lawyer specifies.
- Draft internal status updates from the incident lead's notes.

**AI must not:**

- Must not decide whether a breach is notifiable or whether a court must be told.
- Must not draft communications to a court, client, regulator or insurer without lawyer review.
- Must not be given the incident materials in the tool that caused the incident.

**The lawyer checks:**

- Evidence is preserved before any remediation that would alter it.
- Court corrections are made as soon as possible and recorded.
- Notification decisions under Pt IIIC and the insurance policy are made and documented within the time limits.

## Authorities

- [Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 rr 19.1 and 19.2 (not misleading the court; correcting misleading statements as soon as possible)](https://legislation.nsw.gov.au/view/html/inforce/current/sl-2015-0244#rule.19)
- [Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 r 9 (confidentiality)](https://legislation.nsw.gov.au/view/html/inforce/current/sl-2015-0244#rule.9)
- [Privacy Act 1988 (Cth) Pt IIIC, ss 26WE, 26WH, 26WK and 26WL (eligible data breaches; 30-day assessment; statement and notification)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Federal Court of Australia, Use of Generative Artificial Intelligence Practice Note (GPN-AI), 16 April 2026, paras 4.13 to 4.15 and 5.1](https://www.fedcourt.gov.au/law-and-practice/practice-documents/practice-notes/gpn-ai)
- [Supreme Court of Victoria Practice Note SC Gen 25, 14 May 2026, paras 6.4 and 6.7 (costs orders; referral to the regulator)](https://www.supremecourt.vic.gov.au/areas/legal-resources/practice-notes/sc-gen-25-the-use-of-artificial-intelligence-by-court-users)
- [Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) s 123 (tipping off)](https://www.legislation.gov.au/C2006A00169/latest/text)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/ai-decision-systems/ai-incident-response-procedure and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*