Page two of your AI policy: what to do when it goes wrong
Page one says what may be entered. Page two is the one nobody writes, and the one you will actually need.
Most companies that wrote something for 2 February wrote page one: which tools, what may go in, who checks the output. Good. Page two is what happens when it goes wrong, and it is missing almost everywhere.
It matters because the first incident is always small, and how it is handled decides whether you hear about the second one.
The three incidents that actually happen
Someone pasted something they should not have. A customer list, a contract, a personnel matter. This is the common one, and it is almost always an ordinary person under time pressure, not misconduct.
A wrong answer reached a customer. An incorrect delivery date, a figure that did not reconcile, a legal statement that was not true. Nobody noticed until the customer did.
An automated step ran for weeks doing something slightly wrong. The worst of the three, because the damage compounds quietly.
What page two should say
- Tell someone within the day, and nothing bad happens to you. Write that sentence explicitly. Without it people wait, hope, and you learn about it in a customer email three weeks later.
- Who to tell. One name, the same one from page one.
- The first three actions. Stop the process if it is still running. Write down what happened and when, while it is fresh. Establish what data was involved, exactly — not roughly.
- When it becomes a data protection matter. If personal data went somewhere it should not have, there are notification questions under Swiss law that have deadlines. You do not need to know the answer; you need to know to ask a lawyer promptly rather than eventually.
- What you fix afterwards. Not the person. The reason the approved route was slower or unclear than the unapproved one.
The part that does the work
The first bullet. Every other line on this page is procedure; that one is culture, and it determines whether the procedure is ever used.
A company where the first small incident gets reported the same day will handle the serious one well. A company where it gets hidden will find out about the serious one from someone outside.