# 10.8 When something goes wrong (/managing-ai-workers/governance-and-responsible-use/when-something-goes-wrong) --- type: Document title: "10.8 When something goes wrong" description: "The five steps for the first hour after data goes where it should not, and why near misses and honest reports matter." status: stable order: 210.8 ksor: owner: team:panaversity audience: [ public ] approval: by: process:panaversity at: 2026-10-08T09:07:56Z chapter: "10" part: II expert_status: required concepts: [ "10.8" ] last_verified: 2026-10-08 sources: - id: v1-governance title: "Governance, Risk & Responsible Use: A Crash Course (Panaversity, first edition, verified 2026-10-08)" resource: https://agentfactory.panaversity.org/docs/governance-risk-responsible-use-crash-course - id: anthropic-retention title: "How long do you store my data? (Anthropic Privacy Center, updated 1 July 2026, verified 2026-10-08)" resource: https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data generated: at: 2026-10-08T09:07:56Z by: esl-rewrite/1.2.0+ksor.1 trust_tier: unverified build_id: sha256:2f1e14f2a0f11dbc37eb5856ca9b7d35b4ce4894da74c3328cf61a3c17c03861 dirty: true ksor_version: 0.0.60 --- **In everyday life.** You spill paint on a borrowed rug. Hiding it under the sofa does not clean it, and the owner will find it anyway. If you tell them at once, they can use the right cleaner while the paint is still wet. **What you will learn.** What to do in the first hour after data goes where it should not, and why reports of mistakes that caused no harm matter too. You practice it in step 7 of the lab. **Why it matters.** A mistake hidden for a week cannot be stopped from spreading, and hiding it teaches everyone else to hide theirs. Governance does not promise that nobody makes a mistake. It promises that mistakes are found early enough to stop them from spreading. In this chapter's story, on Sunday, December 6, Maria, the office manager at Brightline, uploaded the company's full vendor file, with bank and tax ID numbers, to her personal AI account. On Monday morning, December 7, her first reaction was to delete the chat and say nothing. That would have destroyed the record that the incident owner needs. The incident owner is the person who decides how to handle what went wrong. At Brightline, that is Dave, the controller. And deleting the chat may not have removed the data. On a personal plan whose setting allows training, which uses chats to improve the AI vendor's models, the AI vendor may keep the data, sometimes for years.[^anthropic-retention] The first hour has five steps.[^v1-governance] 1. **Stop the spread.** Do not forward, re-upload, continue the chat or make new copies. 2. **Record the facts.** Note what data, which route and account, when, and where it went next. 3. **Report promptly** through the organization's process for incidents. If there is none, report to the person who owns the risk. Timing can matter legally, so do not wait for a perfect explanation. 4. **State the facts plainly.** Do not guess and do not defend yourself. 5. **Follow the incident owner's instructions.** Deleting, telling the people whose data it was, and asking the AI vendor for deletion are the incident owner's decisions. These decisions have legal and contractual effects you may not see. Report near misses too. A near miss is a mistake that caused no harm but could have. On December 9, Jordan, a new clerk at Brightline, followed old notes that nobody owned and replied to a supplier's email about new bank details. It caused no loss, because the AP policy's callback rule held the payment. It still showed that knowledge without an owner was being served, given out to staff. A near miss shows where a process is weak, at no cost. How an organization treats the first person who reports an honest mistake decides whether the next ten are reported or hidden.[^v1-governance] Dave did not punish Maria. He fixed the slow company AI workspace that had pushed her to use her personal account. That choice is governance too. ![The title reads "The first hour." The line below it reads "Contain the incident. Preserve the facts. Report promptly." On the left, "Avoid these reactions" crosses out three: "Delete it and tell nobody," "Wait to see if anything happens" and "Check whether anyone noticed." Below them, "Preserve the record: deleting can destroy evidence and may not remove every retained copy," and "Report near misses too. No loss does not mean no weakness." On the right, a panel reads "Five steps to take now." Step 1, stop the spread: stop the task, and do not forward, re-upload or continue the chat. Step 2, record the facts: what data, which route and account, when, and where it went next. Step 3, report promptly: use the incident channel, and if none exists, contact the risk owner. A line under it reads "Report what you know. Do not wait for a complete account." Step 4, state facts plainly: separate facts from unknowns, and do not guess or hide details. Step 5, follow the incident owner: follow instructions on deletion, requests to the AI vendor and notifying affected people. A line reads "Follow your organization's incident procedure throughout." A banner at the bottom reads "Respond constructively to honest reports so people keep reporting."](img/first-hour.png) *Figure 10.5. The first hour, and three reactions to avoid.* [^anthropic-retention]: How long do you store my data?, Anthropic Privacy Center. [^v1-governance]: Governance, Risk & Responsible Use: A Crash Course, Panaversity, first edition.