If your organization uses AI, sooner or later something wrong will get out. A bad figure in a report. A citation that does not exist. An email promising a service you do not offer. Confidential information pasted somewhere it should not have gone. How you handle the first one sets the pattern for every one after it.
First, stop it spreading
Before anyone works out why it happened, keep the damage from growing.
- Correct it where it lives. Update the document, take down or edit the post, fix the shared file.
- Find the copies. Was it forwarded, reused as a template, or pasted into other work?
- Pause the process that produced it if it is still running — especially anything automated that sends without a person approving it.
- Treat exposed information as its own problem. If confidential or personal information went into a tool it should not have, bring in whoever handles privacy or security right away. Depending on the information and your contracts, there may be notification obligations, and counsel should make that call.
Tell the people it affected
If the mistake reached a client, a member of the public, or a partner, tell them. Plainly, promptly, and without hiding behind the tool.
A good correction says three things: what was wrong, what the right information is, and what you are doing about it. It does not say "the AI made an error," as though the software sent it on its own. Your organization sent it. Owning that is what keeps the relationship intact.
What a correction can sound like
Short and specific works better than long and apologetic. Something like:
"In the summary we sent on Tuesday, the renewal date was listed incorrectly. The correct date is the one in your signed agreement. We have updated the document and added a second check to how these summaries are prepared. I am sorry for the confusion, and I am glad to walk through it with you if that would help."
Notice what it leaves out. It does not blame a tool, a new hire, or a busy week. It does not bury the correction in a long explanation. And it does not promise the mistake will never happen again, which nobody can promise. It names the fix you actually made.
Then find out what happened
The easy move is to blame whoever used the tool. The useful move is to ask what let the mistake through. Four questions cover it:
- What did the tool produce, and what exactly was wrong?
- Was the output reviewed? By whom, and against what?
- Why did the review miss it — no time, not enough subject knowledge, no clear instruction, or no review step at all?
- Was this an approved use of AI, with information staff were allowed to put into that tool?
Write the answers down. Keep it short and factual. This is a record of what happened, not a disciplinary file. If the answers show someone knowingly went around the policy, handle that through your normal HR process, separately from fixing the process.
Fix the process, not just the document
Correcting the output handles this mistake. Changing the process is what makes the next one less likely.
| What you found | What to change |
|---|---|
| No review step | Add one, sized to the stakes of the work |
| Reviewer did not know the subject | Send that kind of work to someone who does |
| Review was rushed | Build review time into the deadline, or take AI out of that step |
| Tool used for something it should not be | Clarify the policy and tell staff directly |
| Information went where it should not | Restrict the tool or the data, and retrain |
| Nobody knew who owned the process | Name an owner |
One change, made and explained to the people it affects, is worth more than a long list of recommendations nobody acts on. If ownership was the gap, here is how to assign it.
Do not make people afraid to report
The worst result of an AI mistake is not the mistake. It is staff learning that reporting one gets them in trouble, so the next one gets quietly patched — or quietly ignored.
Make reporting easy. Name one person or one inbox for AI problems. Say clearly that honest reports of mistakes will not be punished. Thank people, out loud, when they raise one. Deliberate misuse is a different matter, and your policy should say where that line sits. But ordinary mistakes are how you find out where a tool is weak for your work. The same thinking applies when you discover staff using AI without approval.
Keep a log, and read it
Keep a simple incident log: the date, what happened, how it was caught, and what changed. Look at it on a regular schedule. Patterns show up — the same kind of mistake, the same process, the same tool — and those patterns tell you where to spend your review and training time. A log that stays empty for months is worth a question too: either things are going well, or people are not reporting.
Get ready before the first one
Most of this takes an afternoon:
- Name who gets told when an AI mistake is found.
- Write the short correction template.
- Decide which mistakes count as privacy or security events, and who handles those.
- Add a line to your AI use policy saying honest reports are welcome.
- Start the incident log, even while it is empty.
Mistakes come with using any tool, AI included. Planning for them means the first one is handled calmly, and the process is stronger afterward.
Questions people ask
What should I do if AI made a mistake in something we sent to a client?
Correct it with the client promptly and plainly: what was wrong, the right information, and what you are changing. Take responsibility as an organization instead of blaming the tool, then find out why your review did not catch it.
Who is responsible when AI makes a mistake at work?
The organization that used the output. A tool does not send anything on its own. Internally, look at the process first — review, training, deadlines, and ownership — before looking at the individual, unless the use was deliberately outside policy.
What if an employee put confidential information into an AI tool?
Bring in whoever handles privacy or security right away, find out what was shared and with which tool, and check that tool's data terms. Depending on the information and your contracts, there may be notification obligations, so involve counsel.
Should employees be disciplined for AI mistakes?
Honest mistakes should not be punished, or people will stop reporting them. Deliberate misuse, such as knowingly putting restricted data into a tool the policy does not allow, is different, and your policy should say where that line is.
What is an AI incident log?
A simple running record of AI mistakes: the date, what happened, how it was caught, and what changed afterward. Looked at regularly, it shows which processes and tools need more review or training.