What an incident would actually look like
Not a breach in the cinematic sense. A twenty-minute conversation about the three realistic scenarios, so that nobody has to work it out under pressure.
Companies plan for dramatic failures and are caught out by mundane ones. For AI use in a Swiss SME, three realistic scenarios cover almost everything, and talking them through takes twenty minutes once.
Scenario one: something confidential went into a consumer tool
Someone pasted a document they should not have. They realise it, or a colleague notices.
What matters is what happens next. If the culture is such that they say nothing, you have an unknown exposure and no ability to answer a customer honestly later. If they can mention it without consequence, you can assess it in ten minutes and usually conclude it was minor.
The single most valuable thing you can establish in advance is that reporting this is not a disciplinary matter. Say it out loud before it happens; it is worthless said afterwards.
Scenario two: a wrong output reached a customer
A figure, a date, a commitment that was not checked. This is not an AI incident in any special sense — it is the ordinary error your existing process already handles.
Handle it the way you would handle a typing error with the same consequence. The only AI-specific part is whether to say how it happened, and the honest answer is usually yes, briefly, because customers hear about it eventually and the version they hear from you is better.
Scenario three: a supplier has an outage or a breach
For an outage, the 22 October answer applies: the short list of processes with no remembered manual route is your exposure, and everything else waits a day.
For a breach at a provider, you need to know quickly whether your data was in scope, which means knowing which provider is behind which tool — the 4 August question, which is the whole reason it was worth asking.
The twenty-minute version
Three scenarios, one named person who is told first, and one sentence confirming that reporting is not punished.
That is the entirety of incident planning appropriate to a company of thirty people. Anything more elaborate will not be read when it matters.