Operating, incidents and decommissioning

Operating AI responsibly

• Keep the AI inventory current: owner, purpose, risk tier, vendor, data, assessments, next review date.
• Monitor outcomes, not just uptime: accuracy, drift, fairness, complaints, misuse.
• Re-review on a schedule and whenever the model, data, purpose, vendor or law changes.

Transparency and recourse

People affected by AI should know it is used, get an explanation of significant decisions, and have a way to contest and reach a human. Many laws require some or all of this (GDPR, EU AI Act Arts. 26 and 86, ECOA adverse-action notices, Colorado, NYC LL 144).

Secondary uses and downstream harm

Systems get used for things they weren't assessed for: a tool built to summarize tickets ends up ranking staff. Forecast likely secondary uses, write the allowed purpose into the inventory and contracts, watch for drift in how the system is used, and re-assess before a new use goes live. Consider harm further down the line too, such as output copied into other systems or decisions.

External communication

Plan what you'll say outside the organization before you need to: notices to people affected, statements to customers and the press, and reports to regulators. Name who approves each, and keep them consistent with what the system's documentation says.

Shadow AI and employee use

Staff will use public generative AI tools whether or not they are allowed. Effective programs:

• Publish an acceptable-use policy that says what data can go where
• Provide approved enterprise tools with data protections
• Apply data-loss prevention controls
• Train people, with examples

Blanket bans tend to drive use underground.

Incident response

1. Define what counts as an AI incident (harmful output, bias found, security breach, safety event, legal breach).
2. Detect and triage by severity.
3. Contain: pause, roll back, restrict, or add human review.
4. Notify as required: regulators (EU serious-incident reporting; data breach rules), affected people, the vendor or provider.
5. Investigate root cause.
6. Remediate and verify the fix.
7. Learn: update assessments, tests, policies and training.

Turning it off, or limiting it

Have a policy and the controls to deactivate a system quickly, or to localize it: limit it to some regions, users or functions, for example to meet one country's rules or while a fault is fixed. The EU AI Act expects the same: human overseers must be able to stop a high-risk system (Art. 14), and providers must withdraw, disable or recall one that doesn't conform (Art. 20). Test the off switch before you need it.

Decommissioning

Retire deliberately: notify users and dependent systems; handle data retention and deletion; archive documentation and logs for legal hold and audit; revoke access and integrations; confirm vendors delete your data.