AI Incident Severity Classification & Escalation Matrix Worksheet
A fill-in-the-blanks worksheet providing the four-tier severity classification framework and escalation matrix the team builds during Week 2 (Day 8-14) of the 30-day AI IR build. Designed for a 2-3 person shared-responsibility team with no prior IR function, plus the executive sponsor who needs to validate the escalation timeframes.
Part of: The 30-Day AI Incident Response Build: From Zero to Usable IR Capability with a Small Team
- Format
- DOC
- Access
- Pro
Reference document
AI Incident Severity Classification & Escalation Matrix Worksheet
A fill-in-the-blanks worksheet providing the four-tier severity classification framework and escalation matrix the team builds during Week 2 (Day 8-14) of the 30-day AI IR build. Designed for a 2-3 person shared-responsibility team with no prior IR function, plus the executive sponsor who needs to validate the escalation timeframes.
Document ID
DOC-0010
Category
General
Access tier
PRO
Date
12 August 2026
This worksheet serves Step 3 — Week 2 (Day 8-14): Build AI-Specific Severity Classification and Escalation Matrix. By end of Day 14, your team should have both parts filled in, reviewed by your executive sponsor, and pinned in the #ai-incident channel for immediate use. The output feeds directly into the Week 4 containment runbook exercises.
Part A: Severity Classification Framework
Tier Reference
Start by internalizing the four tiers. Every AI incident gets classified against both a failure mode and one of these severity levels.
| Tier | Label | Posture | Response-Time SLA |
|---|---|---|---|
| Sev-1 | Critical | Active customer harm or broad business disruption; all hands | Acknowledge ≤ 15 min, contain ≤ 4 hr |
| Sev-2 | High | Significant degradation with confirmed customer exposure | Acknowledge ≤ 30 min, contain ≤ 8 hr |
| Sev-3 | Moderate | Detectable degradation; limited or no customer-visible harm | Acknowledge ≤ 2 hr, contain ≤ 24 hr |
| Sev-4 | Low | Early-warning signal above baseline; no customer impact | Acknowledge ≤ 1 business day, monitor |
Failure-Mode Classification Grid
Each row maps a failure mode to a severity tier with concrete impact criteria, a customer exposure threshold, and the SLA. Adjust thresholds to your user base before finalizing.
| Failure Mode | Sev | Impact Criteria | Customer Exposure Threshold | SLA |
|---|---|---|---|---|
| Distribution shift | Sev-1 | Outputs degraded across all segments; harmful or systematically wrong content reaching end users | ≥ 10% of active users receiving degraded outputs | Ack ≤ 15 min, contain ≤ 4 hr |
| Distribution shift | Sev-2 | Degradation in a major user segment; some inaccurate outputs reaching customers | 1–10% of users, or a single high-value customer segment affected | Ack ≤ 30 min, contain ≤ 8 hr |
| Distribution shift | Sev-3 | Drift detected in a query subset; outputs suboptimal but not harmful | < 1% of users; no complaints received | Ack ≤ 2 hr, contain ≤ 24 hr |
| Distribution shift | Sev-4 | Early drift signals above baseline; outputs within tolerance | No customer-visible impact | Ack ≤ 1 business day, monitor |
| Prompt manipulation | Sev-1 | Active exploitation; sensitive data exfiltration or harmful content generation at scale | Multiple users affected or exploit publicly known | Ack ≤ 15 min, contain ≤ 4 hr |
| Prompt manipulation | Sev-2 | Targeted manipulation succeeding against guardrails; limited data exposure | 1–5 users confirmed exploited | Ack ≤ 30 min, contain ≤ 8 hr |
| Prompt manipulation | Sev-3 | Injection attempts detected; guardrails holding; no successful extraction | Attempts logged, no confirmed breach | Ack ≤ 2 hr, contain ≤ 24 hr |
| Prompt manipulation | Sev-4 | Probing patterns detected; no successful manipulation | No exposure | Ack ≤ 1 business day, monitor |
| Training-data contamination | Sev-1 | Poisoned data in production model; systematically biased or harmful outputs live | Customers receiving biased or harmful outputs | Ack ≤ 15 min, contain ≤ 4 hr |
| Training-data contamination | Sev-2 | Contamination confirmed in current model; outputs affected for a segment | A user segment receiving degraded outputs | Ack ≤ 30 min, contain ≤ 8 hr |
| Training-data contamination | Sev-3 | Contamination suspected; model anomalies within tolerance | No customer-visible impact | Ack ≤ 2 hr, contain ≤ 24 hr |
| Training-data contamination | Sev-4 | Data quality flag in training pipeline; no model impact evidence | No exposure | Ack ≤ 1 business day, monitor |
| Third-party model or API changes | Sev-1 | Provider breaking change; production system down or producing critical failures | All users affected | Ack ≤ 15 min, contain ≤ 4 hr |
| Third-party model or API changes | Sev-2 | Provider change degrading a major feature; partial service impact | A major feature degraded for a user segment | Ack ≤ 30 min, contain ≤ 8 hr |
| Third-party model or API changes | Sev-3 | Provider announced change; current version functional; migration window open | No current impact; future risk identified | Ack ≤ 2 hr, contain ≤ 24 hr |
| Third-party model or API changes | Sev-4 | Provider minor version bump; no observed impact | No exposure | Ack ≤ 1 business day, monitor |
| Configuration drift | Sev-1 | Pipeline misconfiguration; safety guardrails disabled or bypassed; harmful outputs at scale | Customers receiving unguarded outputs | Ack ≤ 15 min, contain ≤ 4 hr |
| Configuration drift | Sev-2 | Config change degrading performance for a segment; partial guardrail impact | A user segment receiving degraded outputs | Ack ≤ 30 min, contain ≤ 8 hr |
| Configuration drift | Sev-3 | Drift detected; performance within tolerance; no customer-visible impact | No customer-visible impact | Ack ≤ 2 hr, contain ≤ 24 hr |
| Configuration drift | Sev-4 | Minor config variance; no observable impact | No exposure | Ack ≤ 1 business day, monitor |
Continue with a free account
This document is part of our Pro client library. A free account gives you access to all free resources only — to unlock the full library, become a client.
Free accounts unlock free resources only.
Get this document
Available to Pro clients. A free account covers free resources only.
Become a clientDocument info
- Format
- DOCPDF export
- Access tier
- Pro
- Category
- General
- Published
- 12 August 2026