10.8 When something goes wrong

In everyday life. You spill paint on a borrowed rug. Hiding it under the sofa does not clean it, and the owner will find it anyway. If you tell them at once, they can use the right cleaner while the paint is still wet.

What you will learn. What to do in the first hour after data goes where it should not, and why reports of mistakes that caused no harm matter too. You practice it in step 7 of the lab.

Why it matters. A mistake hidden for a week cannot be stopped from spreading, and hiding it teaches everyone else to hide theirs.

Governance does not promise that nobody makes a mistake. It promises that mistakes are found early enough to stop them from spreading. In this chapter's story, on Sunday, December 6, Maria, the office manager at Brightline, uploaded the company's full vendor file, with bank and tax ID numbers, to her personal AI account. On Monday morning, December 7, her first reaction was to delete the chat and say nothing. That would have destroyed the record that the incident owner needs. The incident owner is the person who decides how to handle what went wrong. At Brightline, that is Dave, the controller. And deleting the chat may not have removed the data. On a personal plan whose setting allows training, which uses chats to improve the AI vendor's models, the AI vendor may keep the data, sometimes for years.¹

The first hour has five steps.²

1. Stop the spread. Do not forward, re-upload, continue the chat or make new copies.
2. Record the facts. Note what data, which route and account, when, and where it went next.
3. Report promptly through the organization's process for incidents. If there is none, report to the person who owns the risk. Timing can matter legally, so do not wait for a perfect explanation.
4. State the facts plainly. Do not guess and do not defend yourself.
5. Follow the incident owner's instructions. Deleting, telling the people whose data it was, and asking the AI vendor for deletion are the incident owner's decisions. These decisions have legal and contractual effects you may not see.

Report near misses too. A near miss is a mistake that caused no harm but could have. On December 9, Jordan, a new clerk at Brightline, followed old notes that nobody owned and replied to a supplier's email about new bank details. It caused no loss, because the AP policy's callback rule held the payment. It still showed that knowledge without an owner was being served, given out to staff. A near miss shows where a process is weak, at no cost.

How an organization treats the first person who reports an honest mistake decides whether the next ten are reported or hidden.² Dave did not punish Maria. He fixed the slow company AI workspace that had pushed her to use her personal account. That choice is governance too.

Figure 10.5. The first hour, and three reactions to avoid.