The AI Incident Response Lead owns the enterprise incident and problem process (OPR02/OPR03) for AI and agentic systems, which no other role in the set owned. Role 2.2 detects and executes technical actions. Role 3.2 runs security detection. Role 23.1 revokes agent identities and permissions. Role 4.1 governs emergency activation. Role 8.6 reports to authorities (STD14 Q1, decided 18 October 2026: Role 8.6 prepares and tracks deadlines, Role 1.2 files as sole authority contact under t249, Role 1.1 is informed). This role classifies, escalates, contains, investigates and restores — and makes sure incidents produce root causes and improvements.

Standing duties

• Own OPR02/OPR03 for AI: one intake for incidents, vulnerability disclosures, complaints and unexpected agent behaviour; classification, severity and escalation.
• Direct containment of affected agents (permission revocation, isolation, quarantine) and prevent propagation across collaborating agents, tools and workflows.
• Maintain independent and scalable investigation capability for agent evidence: trajectories, delegation chains, logs and prompts.
• Restore operations only after safeguards are verified, and maintain business continuity for functions that depend on agents.
• Do not treat a closed ticket as residual-risk acceptance; residual risk returns to Role 1.4 / 1.1.

Accountable to: AI Governance Lead / Head of AI Operations (or GM: Operations)

Primary domain: Operate (OPR02 incidents and OPR03 problems for AI and agentic systems) and Review (root cause). Does not Direct or accept residual risk.

Linked EN 18286 clauses: 8.6, 9.6.1, 9.6.2.1, 9.6.2.2, 9.7.2.1, 10.1.1, 10.1.1.2

Format: 3 hours of training, EUR 200.