The AI Crisis Preparedness Handbook
What leaders do in the first hour, the first day and the first week when an AI system goes wrong.
Not another AI risk explainer
Most incident plans assume software does what it was written to do, data is just data, and a person is behind every action. AI breaks all three. This handbook tells boards, CISOs, legal, risk, communications and business leaders what to decide, in what order, and who decides it when an AI system takes a harmful action, leaks data, says something it shouldn't, is impersonated, changes silently or goes down.
First hour, day and week
Checklists you can run at 2am, starting with the six facts to establish: what the AI could see, decide and do, under whose authority, whether that authority is contained, and whether its actions can be rebuilt and reversed.
Contain, don't just kill
Eight containment options, from pausing actions to switching to manual, so you stop the harm without stopping the business.
Roles and decision rights
Who can contain, who can undo, who talks to regulators and who approves a restart. Fill it in before you need it.
Regulatory clocks
EU AI Act Article 73, EU and UK GDPR, NIS2, DORA and SEC Item 1.05, with what starts each clock and links to the sources.
Restart and board briefing
Restart criteria, including restarting with less authority and earning the rest back, and the five questions every board asks.
13-question readiness check
An honest score of where you stand today, and where to start.
Seven scenarios, with real cases
- AAn AI agent takes a harmful action
- BData leaks through an AI system
- CYour AI tells people something false or binding
- DDeepfake impersonation of your leaders
- EA vendor's AI misbehaves
- FThe model changed and nobody noticed
- GYour model or AI provider becomes unavailable
Each scenario names the AI Control Architecture pillars that would have prevented it or limited the damage.
Download the handbook
Free, no sign-up needed on this page. Provided as is under the Terms of use.
Download the PDF (19 pages)Start with three things: fill in the roles table (Section 4), take the readiness check (Section 12), and print the first-hour checklist (Section 6).
Build your organisation's plan
The handbook gives you the generic version. The AI Crisis Readiness Review, offered by Keystone Executive (Ankush Chowdhary's consulting practice), builds yours: an independent, vendor-agnostic assessment of up to three of your critical AI systems in 10 business days.
Roles and decision rights
Who contains, who undoes, who notifies and who approves a restart, with names.
Containment options
What each of your systems supports today, and what it should.
Your procedures
First-hour, first-day and restart procedures written for your systems.
Notification triggers
The regimes that may apply and what starts each clock, as input for your counsel.
Five most dangerous gaps
And a prioritised 30-day plan with owners and effort.
Executive readout
60 minutes with your leadership team: findings, decisions, next steps.
10 business days · up to 3 critical AI systems · fixed fee US$9,500. Once the plan exists, a tabletop exercise tests whether the organisation can execute it.
View the Review one-pager Talk to Keystone ExecutiveAbout the author
Ankush Chowdhary has spent 30 years in cybersecurity and created the AI Control Architecture, an open, vendor-agnostic framework of ten control pillars for governing, securing and containing enterprise AI, and the Recursive Cyber Defense Model. He leads Keystone Executive. More about the author.
Terms of use
The handbook is provided free of charge, as is, without warranty of any kind, express or implied, including fitness for a particular purpose, accuracy or completeness. By downloading or using it, you accept that the publisher and authors are not liable for any loss or damage arising from its use or from decisions made in reliance on it. It is general information, not legal, regulatory or professional advice; you are responsible for your own due diligence and for confirming your obligations with qualified advisers. Licensed under CC BY 4.0.