Something went wrong. Here is the first 24 hours.
The five things that actually happen to small companies, each with the first steps and who to tell. Breach notification deadlines depend on where the affected people live; tick the places below to see the duties.
Where do the affected people live?
An employee pasted customer or confidential data into an AI tool
- Identify the tool, the account tier, and its data settings in the Tool Register.
- If the tier trains on data or retains it, submit a deletion request to the vendor and record it.
- Assess what data it was and whether any law treats it as a breach (personal data, health, financial).
- Remind the team of the acceptable use policy; do not punish the reporter.
- Log the incident with dates, data, tool, and actions.
A call, voicemail, or video asked for an urgent payment or a change of bank details
- Stop. Verify through a number you already had on file.
- If money moved, call your bank immediately to attempt a recall, then report to the FBI's IC3.
- Preserve the message, number, and any files.
- Tell finance and executives the same day; attackers try several people.
- Log it and review the payment verification procedure.
A vendor that holds your data reported a breach
- Get the vendor's written notice: what data, whose, when, what they have done.
- Check the inventory for what you gave that vendor and which customers or employees are affected.
- Determine your own notification duties by jurisdiction; some clocks start at discovery.
- Rotate credentials and keys shared with the vendor.
- Log it and decide whether the contract and the vendor review need to change.
A candidate, customer, or employee complains that an AI-assisted decision was unfair
- Pause automated decisions of that kind if you can.
- Pull the record: inputs, output, who reviewed, what was decided.
- Check which laws apply (employment: Illinois, NYC Local Law 144, Colorado from 2027; EU high-risk duties).
- Offer a human review and respond in writing.
- Log it; it is evidence for your oversight control and may be reportable.
Your chatbot or AI feature said something wrong, harmful, or embarrassing
- Capture the exchange and turn the feature off or restrict it if the harm could repeat.
- Check whether anyone acted on the output and whether people were affected.
- Review disclosures: did users know they were talking to AI?
- Fix the prompt, guardrails, or data, and test before re-enabling.
- Log it; if the system is high-risk under the EU rules, check the incident reporting duty.
These are starting points, not legal advice. If personal data may be involved, talk to counsel the same day; clocks can start at discovery.