Use the existing reporting route, but make sure it recognizes AI-specific problems such as unintended disclosure, unsupported customer-facing statements, or an agent taking an unauthorized action. Record the use case, affected data or users, relevant version and configuration, and what happened. Preserve necessary evidence with appropriate access restrictions. Assign responsibility for containment, investigation, communication, and safe restoration. A mistaken output is not automatically a reportable breach, but it still needs assessment against your commitments and applicable obligations. Feed lessons back into approvals, testing, and training instead of treating each event as an isolated prompt-writing problem.
Related: SOC 2 audit and compliance hub.
Further reading: NIST Generative AI Profile.
