Recommended Free Tools
If an AI system harms someone, treat the event as an active safety, security, governance and potentially legal incident. Protect people first, stop or constrain the affected workflow, preserve the system state, assign one incident owner and determine which authorities or safeguarding channels may apply. Do not wait for a perfect diagnosis before taking reversible steps that prevent further exposure.
This guide sets out a practical response from the first minutes through investigation, notification, remediation and closure. It covers actual injuries, privacy or discrimination failures, financial loss, unsafe recommendations, security misuse and credible near misses.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first hour
- Protect people immediately. If there is an imminent threat to life, health, a child or another vulnerable person, use emergency services, clinical escalation, safeguarding or security channels appropriate to your location. Do not leave an AI workflow running while a team debates responsibility.
- Stop repeat exposure. Disable the affected feature, pause automated actions, remove unsafe outputs from queues, restrict access or require human approval. Prefer a reversible control such as a feature flag or account restriction over destructive changes.
- Appoint one incident owner. Give one named person authority to coordinate safety, engineering, legal, communications and vendor contacts. Record deputies and an always-monitored contact method.
- Open a time-stamped decision log. Record who made each decision, when, what evidence was available, what uncertainty remained and what residual risk was accepted.
- Preserve the original state. Capture prompts, inputs, outputs, model and policy versions, retrieval results, tool calls, access logs, user reports, screenshots, downstream decisions and deployment configuration before routine cleanup, retraining or rollback can overwrite them.
- Separate containment from diagnosis. A temporary shutdown can be justified even when causation is uncertain. Mark hypotheses as hypotheses; do not present an unverified explanation as fact.
- Start a jurisdiction map. List affected countries, business locations, customers, data subjects and regulated sectors. Privacy, discrimination, consumer-protection, employment, product-safety, medical-device, financial-services, cybersecurity and critical-infrastructure duties may apply in addition to AI-specific rules.
- Set the next review time. Assign a short interval for reassessing harm, containment and reporting obligations. An incident that appears isolated can expand when queued outputs, downstream decisions or shared model infrastructure are examined.
How to preserve evidence after an AI failure
Evidence should allow an independent reviewer to reconstruct what the system knew, what it produced, what tools it used and what people did next. Preserve the original material read-only where feasible, and conduct experiments on a controlled copy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Capture the system and deployment state
- System name, model family, exact model or API version, policy and safety-filter versions.
- Prompt templates, system instructions, user prompts, input files, retrieved documents, embeddings or search results and output formatting rules.
- Tool calls, function arguments, API responses, code executed, permissions used and external side effects such as messages, purchases or record changes.
- Deployment configuration, feature flags, routing, temperature or other generation settings, region, tenant, container or hardware identifiers and dependency versions.
- Authentication, authorization, access, rate-limit, monitoring and alert logs with their time zone and clock source.
Capture the human and business context
- Original user reports, support tickets, screenshots, recordings and relevant correspondence.
- The output as seen by the affected person, including interface warnings, confidence labels, citations and any missing or misleading context.
- Downstream decisions, approvals, denials, notifications, clinical or operational actions and records changed because of the output.
- Identity categories and approximate numbers of affected stakeholders where lawful and necessary; avoid collecting sensitive data that does not support the investigation.
- Copies of contracts, vendor notices, internal policies, training material and instructions that shaped reliance on the system.
Protect integrity and chain of custody
Hash exported files where practical, preserve original timestamps, record who collected each item and store a read-only copy with controlled access. Note any missing logs, clock drift, redaction or transformation. If privacy law limits retention or sharing, document the legal basis and the minimum data needed for the investigation; do not quietly delete evidence to simplify compliance.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
How to classify the event
Incident, hazard or near miss
The OECD terminology distinguishes an incident, where harm actually occurred, from a hazard, where a credible danger exists even without injury. Keep near misses in the same process: a blocked transaction, caught hallucination or rejected unsafe recommendation may reveal a control that is about to fail. Classification can change as facts develop, so record the initial label and every later change.
Record the harm and severity
Describe the harm in concrete terms rather than using only a severity score. Relevant categories include physical, psychological, reputational, economic or property, environmental, public-interest or critical-infrastructure, and human or fundamental-rights harm. Record whether the event is a hazard, incident, serious incident or disaster; whether it is ongoing; how many people may be affected; and whether any group is especially vulnerable.
Minimum incident record
The OECD’s 2025 reporting framework contains 29 criteria. A usable record should include:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Incident identifier, first known occurrence, discovery time and current status.
- Countries and affected locations, system and model name, version, provider, developer, deployer and relevant vendors.
- Severity, harm type, affected stakeholder categories and a lawful estimate of injury, loss, compensation or other impact.
- Prompts, inputs, outputs, logs, screenshots, tool actions and supporting material, with evidence custody information.
- Direct cause, contributing factors, failure to act, overreliance, intentional misuse, human error and possible legal non-compliance.
- Containment, notifications, corrective actions, owners, deadlines and residual risk.
How to choose containment and escalation actions
Use the same decision axes for every proposed action: immediacy of human-safety benefit, reversibility, severity and type of harm, confidence in causation, number and vulnerability of affected people, jurisdiction, risk of destroying evidence, reporting deadline, transparency needs and residual risk after the action.
| Situation | Immediate control | What to document |
|---|---|---|
| Credible imminent danger | Stop the workflow, alert emergency or safeguarding contacts and provide human intervention. | Threat assessment, time of escalation, people contacted and protective steps. |
| Ongoing automated harm with uncertain cause | Pause automation or require human approval; preserve a copy before rollback. | Scope of the pause, affected queues, hypotheses and review time. |
| Contained harm with stable evidence | Restrict users, revoke credentials or quarantine the model while testing a controlled copy. | Access changes, test plan, success criteria and residual exposure. |
| Systemic or cross-border impact | Activate executive, legal, privacy, security and regulator coordination. | Jurisdiction map, contact owners, notification analysis and deadlines. |
When must an AI incident be reported?
There is no single worldwide reporting clock. Make a jurisdiction-by-jurisdiction map before deciding that an event is “internal only.” A duty may arise from the sector or harm—such as a data breach, discriminatory employment decision, unsafe product, medical-device failure, financial loss or critical-infrastructure disruption—rather than from an AI statute.
EU high-risk AI systems: Article 73
Under Article 73 of the EU AI Act, a provider of a high-risk AI system reports a serious incident to the market-surveillance authority where it occurred. The normal maximum is 15 days after the provider becomes aware, with the report made immediately after establishing a causal link or the reasonable likelihood of one. A widespread infringement or the specified serious-incident category has a maximum of two days; where a person dies, the maximum is 10 days. These are maximums, not permission to wait when the facts are already clear.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
| Article 73 situation | Maximum timing stated in the rule | Operational response |
|---|---|---|
| Other serious incident after causal link or reasonable likelihood is established | Immediately, and no later than 15 days after awareness | Open the report as soon as the threshold is met; update it as facts improve. |
| Widespread infringement or the specified serious-incident category | Two days | Use an accelerated legal and executive approval path. |
| Death of a person | Ten days | Coordinate evidence, authorities, affected parties and any sector-specific duties without delay. |
The Article 73 text allows an initial report to be incomplete and followed by a complete report. The provider must investigate without delay, perform a risk assessment, take corrective action, cooperate with authorities and avoid altering the system in a way that could affect evaluation before informing authorities.
General-purpose AI models with systemic risk
For general-purpose AI models classified as presenting systemic risk, the EU AI Act Service Desk says providers must keep track of, document and report serious incidents and possible corrective measures without undue delay to the AI Office and, where appropriate, national competent authorities. A deployer or downstream user should escalate through its provider and competent authorities rather than assume that model-level reporting is someone else’s responsibility.
What a regulator-ready submission needs
Prepare a factual chronology, system identity and version, locations, affected people, harm and severity, evidence summary, suspected causal link, containment, corrective action, cooperation contact and a plan for follow-up. State what is unknown. An honest preliminary report is safer than a confident explanation that later proves wrong.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
How to investigate the root cause
Build a complete timeline
Start with the first model or system action, not the moment a complaint arrived. Include data ingestion, retrieval, prompt assembly, model generation, tool execution, human review, downstream decision, discovery, containment, notification and recovery. Normalize time zones and note clock drift so apparently impossible sequences are not mistaken for system behavior.
Test every layer of the system
- Model behavior: hallucination, bias, unsafe refusal, prompt injection susceptibility, distribution shift or a regression between versions.
- Data: stale, poisoned, incomplete, unlawfully obtained or incorrectly labeled training and retrieval data.
- Retrieval and orchestration: wrong document, tenant leakage, context truncation, routing error or an instruction hierarchy that let untrusted content override controls.
- Tools and permissions: excessive privileges, missing confirmation, unsafe function arguments, credential theft or an external service failure.
- Human factors: overreliance on fluent output, unclear responsibility, inadequate training, misleading confidence cues or a review process that could not realistically catch errors.
- Deployment and monitoring: an unsafe use context, disabled alert, untested change, vendor dependency, missing rate limit or feedback channel that did not reach the owner.
- Intentional misuse: abuse, evasion, fraud or an attack that exploited otherwise documented behavior.
Separate causes from contributing factors
Write a root-cause record with distinct fields for direct cause, contributing conditions and failures to act. For each proposed cause, identify the evidence that supports it, evidence that would disprove it and a test owner. Reproduce the event only on a controlled copy with synthetic or minimized data. Quantify affected people, transactions, exposure duration and losses where possible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to remediate and recover
Choose corrective action proportionate to residual risk, not merely to the visibility of the incident. Options include pausing or rolling back a release, restricting users or geographies, adding human approval, changing prompts or policies, retraining or replacing a model, revoking credentials, correcting records, notifying affected people, compensating losses and reporting additional incidents.
- Define a safety objective and a measurable release or restart criterion.
- Implement the smallest reversible control that achieves immediate risk reduction.
- Test normal, edge, adversarial and vulnerable-user scenarios on a controlled copy.
- Have independent safety, legal, privacy or security reviewers challenge the proposed fix.
- Deploy in stages with enhanced monitoring, a rollback plan and an owner for every alert.
- Notify affected people when they need to protect themselves, correct a decision or exercise a legal right. Explain what happened, what was done and how to obtain human review.
- Keep a residual-risk statement: what remains possible, who accepted it and when it will be reassessed.
Practical AI incident-report template
- Identity: incident ID, owner, discovery time and current status.
- System: model, version, provider, deployer, environment, configuration and geography.
- Description: what happened, how it was detected and whether it is ongoing.
- Impact: people, organizations or public systems affected.
- Classification: hazard, near miss, incident, serious incident or disaster; harm and severity.
- Evidence: preserved artifacts, collection method, storage location and chain of custody.
- Causation: direct cause, contributing factors, misuse, human error and control failures.
- Response: containment, notifications, corrective actions, approvals and residual risk.
- Regulatory work: applicable authorities, deadlines, submissions and contact owners.
- Closure: follow-up tests, monitoring changes, lessons learned, outstanding actions and closure criteria.
How to communicate without creating a second incident
Use a single factual narrative across support, executives, regulators, customers and staff. Distinguish confirmed facts, reasonable inferences and open questions. Avoid blaming an individual before the investigation is complete, exposing personal data, publishing exploit details that enable repeat harm or promising that a patch eliminates all risk. Preserve a copy of every material notification and the approval record behind it.
Controls to add after recovery
Close the loop across the AI lifecycle rather than treating the patch as the end. Update monitoring and evaluation, access management, red-teaming, change management, vendor oversight and user-feedback routes. Re-test after model, prompt, policy, retrieval, tool, data or infrastructure changes. NIST describes its AI Risk Management Framework as helping “developers, users and evaluators of AI systems better manage AI risks” and says it spans “pre-design, design and development, deployment, use, and test and evaluation.” Its Generative AI Profile is NIST-AI-600-1, released July 26, 2024; the AI RMF Playbook was released March 30, 2023.
Use post-incident training to show operators the actual failure mode, the correct escalation path and the limits of automation. Test whether a new control works for people with different languages, disabilities, access levels and working conditions. Keep vendor contracts aligned with log access, notification, cooperation, evidence retention and rollback responsibilities.
When is the incident closed?
Closure requires more than restoring service or replacing a model. The owner should confirm that immediate danger is controlled, affected people have received necessary assistance, required reports and updates were submitted, evidence is preserved, corrective actions passed defined tests, residual risk has an accountable owner and monitoring can detect recurrence. Record a closure date and schedule a later effectiveness review; a control that works on release day can degrade as users, data and connected tools change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
