Turn AI incidents and near misses into better practice

Capture a failure or near miss, understand its impact and agree specific changes to the workflow, checks or permissions before repeating the task.

Purpose and fit

Use this after an unexpected output, unauthorised action, missed check or near miss. Address immediate safety, security and operational needs through the existing incident process first. A learning review must not delay required escalation or response.

Before you start

Use only the existing incident summary and records approved for this tool and audience. Dates, observations and control descriptions may be incomplete; identify that limitation instead of reconstructing facts as if observed. Do not copy confidential incident evidence into an unapproved tool. A sanitised summary is sufficient for a draft learning-review structure.

Use only information you are authorised to share with the chosen AI tool. Adjust the prompt to the fields and context you actually have; a specially created dataset is not required.

Required inputs

The known event, affected workflow and current status
Authorised records of inputs, outputs, actions and approvals
A timeline, relevant versions/configuration and the intended controls
People who can explain the workflow and verify the impact

Practical workflow

Establish who is handling the event and which work must pause. The authorised owner takes any containment action; preserve relevant evidence according to existing policy.
Reconstruct the timeline using available records. Separate confirmed facts, reported observations and hypotheses. Record what remains unknown.
Examine contributing conditions: ambiguous instructions, unsuitable inputs, missing controls, interface design, workload, review failures or tool behaviour. Avoid assigning a single cause without evidence.
Agree specific corrective actions with owners. Prefer changes that reduce the chance or impact of recurrence and can be checked. Include a targeted test for each important change.
Verify completion and effectiveness, then have the authorised owner decide whether and under what conditions work may resume. Track residual uncertainty and any additional monitoring needed.

Expected output

Expect an evidence-labelled timeline, questions and draft action log, not a forensic finding, verified fix, clearance to resume or determination of responsibility. Existing incident response must continue independently of this drafting exercise.

A learning review and action log:

A near miss should record what prevented harm and whether that protection was dependable or accidental.

Human checks

The incident lead or process owner checks facts, escalation and record handling. Limit access to sensitive details and keep a sanitised learning summary separate when needed. A person other than the action owner can verify important fixes where practical. External notifications, permission changes and resumption follow existing authority and review requirements.

Limitations

Incomplete records may prevent a firm explanation. One fix may address only one pathway. A learning review does not determine legal responsibility, replace an investigation or justify sharing incident details with an unapproved tool or audience.

Starter prompt

Help structure a learning review from this approved, sanitised incident summary: [summary]. Existing response obligations and owners are [rules/roles].

Create a timeline separating confirmed facts, reported observations and hypotheses. Identify gaps between intended controls and observed behaviour. Suggest questions about contributing conditions without blaming individuals or inventing a root cause. Draft an action log with fields for owner, due date, verification evidence and resumption authority; leave those fields blank unless supplied. Flag unresolved impact and evidence gaps. Do not recommend deleting evidence, contacting affected parties or changing permissions without the established approval process.

Attribute timeline entries to supplied records and distinguish confirmed facts, reports and hypotheses. Preserve conflicting accounts and unknown impact. Keep suggested corrective actions separate from completed or verified fixes; leave owner, due date and resumption approval blank unless recorded. Do not delay escalation while waiting for missing evidence.

Before drafting, ask a focused question if a missing detail materially changes the task or acceptance criteria. Otherwise produce a clearly limited draft and list the gaps. Label any non-critical assumptions; never invent facts, figures, sources, approvals or completed actions.

Data and AI output disclaimer

Use relevant data that exists or that you provide, with accuracy and completeness sufficient for the task. Different AI models and versions may produce different results, and responses may vary between runs. You are responsible for checking and validating the output against your own requirements, source information and acceptance criteria before relying on it.