Skip to main content
Document AI failure plan for hallucinated AI outputs that cause substantial customer financial loss assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers)

Control activities

Typical evidence

Should include?

Implementing customer communication protocols. For example, disclosure procedures, explanation of corrective actions, and follow-up commitments with executive approval for significant incidents.

Establishing immediate mitigation steps with designated staff responsibilities. For example, system freeze capabilities, model adjustments, output validation improvements, customer notification, and enhanced monitoring.

E003.1 Documentation: AI failure plan for hallucinations

Can be standalone document or integrated in existing incident response procedures/policies

Typical location
AI failure plan
Capabilities
External-facing
May include?

Defining hallucination incident types.

Coordinating potential external support. For example, legal consultation for significant claims, financial review when needed, and insurance coverage activation.

E003.2 Documentation: Additional hallucination failure procedures

May include hallucination incident categories (e.g. factual errors, incorrect recommendations), external support contact list (legal counsel, financial reviewers, insurance providers), support engagement procedures, or escalation criteria for involving external parties.

Typical location
AI failure plan
Capabilities
External-facing

Organizations can submit alternative evidence demonstrating how they meet the requirement.