It is a Tuesday morning in a busy aesthetics clinic. The AI assistant that answers enquiries overnight, books consultations and sends aftercare reminders has gone quiet. No replies are going out. The booking calendar is not updating. Nobody on the front desk knows whether the problem is at the clinic's end or the supplier's, and nobody knows who to call.
The clinic has an incident response plan, business continuity plan, and disaster recovery arrangements. However, none adequately addresses the AI assistant I that now handles the first conversation with almost every new client.
This gap is common. Most UK businesses adopted AI tools faster than they updated the plans meant to keep them running. The tools sit inside daily work but outside the documents that say what happens when things break.
This article explores how AI-related incidents and outages affect business operations and the practical steps leaders can take to strengthen their existing incident response, business continuity and disaster recovery arrangements before it costs you.
Why Your Existing Plans May Not Account for AI
An incident response plan establishes how an organisation identifies, assesses, escalates, contains and responds to incidents. A business continuity plan sets out how essential business operations continue during disruption, while a disaster recovery plan focuses on restoring affected systems, services and data.
These arrangements work together, but each serves different purposes..
These plans were usually written around things the business owns. Servers, laptops, phone lines and the office itself.
AI tools do not fit that model. You rent them. Someone else runs them. Staff often start using them before anyone signs off. The features change every few weeks, and many tools you already pay for now include AI you never chose.
For business leaders, the challenge is understanding where AI has become part of critical operations, who is accountable for managing the associated risks and whether existing plans remain effective.
The government’s own figures show how far planning lags behind use. Of UK businesses using, adopting or considering AI, only around a quarter (24%) had security practices in place to manage the risks. Only 25% of businesses had a formal incident response plan, and just 15% formally reviewed the cyber risks from their immediate suppliers.
Four Ways an AI Tool Can Fail You
AI-related incidents are not limited to service outages. They can involve unavailable systems, failures affecting interconnected services, supplier disruption or unexpected AI behaviour that compromises business operations, data or customer trust.
Each scenario may require a different response, including incident management, business continuity measures or disaster recovery activities.
The Service Goes Down
On 3 September 2026, ChatGPT, Claude and Grok all suffered outages on the same morning. Forbes reported more than 37,000 Downdetector reports for ChatGPT alone, and disruption across the three services spanned roughly five hours from first failure to full recovery.
This was not a one-off. ChatGPT had smaller, separate incidents on 27 and 31 August. Outages are a normal part of running on someone else’s service. The question is what your team does during them.
Something You Use Depends on It
Many business tools run on the same small number of AI models underneath. During the September outage, the coding tool Cursor confirmed its own outage because it depends on Claude and Grok.
Small businesses have seen the same effect. One founder noticed that HubSpot's built-in AI feature went down at the same moment as ChatGPT, which suggested it relied on OpenAI in the background. Your CRM, helpdesk or website chat may share a single point of failure you cannot see.
The Supplier Disappears
Outages end. Insolvency does not. London-based Builder.ai, backed by Microsoft and the Qatar Investment Authority, filed for bankruptcy after a major creditor seized most of its cash. Customers who relied on its platform were left uncertain about their applications and plans.
If your client records, scripts or knowledge base live only inside an AI supplier's platform, their failure becomes your data loss.
The Tool Does the Damage
Sometimes the AI works and causes the disaster itself. In 2025, Replit's AI assistant issued commands that erased a production database holding records on 1,206 executives, despite being told not to make changes. The user was told no backup existed, but the AI was wrong and the data could be restored.
Two lessons follow. AI tools with permission to change your systems need the same backup cover as anything else. And a tool's own account of what went wrong is not a recovery plan.
Why AI Outages Are a Data Protection Question Too
AI incidents are not solely an IT concern. Depending on the circumstances, they can affect personal data, business operations, contractual obligations, and regulatory compliance.
Under UK GDPR, security is not just about keeping data private. It is also about keeping it available.
Article 32 requires appropriate technical and organisational measures, taking account of the risks involved. These include, where appropriate, the ability to restore access and availability to personal data in a timely manner following a physical or technical incident, alongside processes for regularly testing and evaluating security measures.
Where an AI tool supplier processes personal data on behalf of your organisation, you remain accountable for your obligations as a data controller. This includes assessing the supplier’s security and recovery arrangements and understanding how an incident could affect the personal data being processed.
Not every AI outage constitutes a personal data breach. However, incidents affecting the confidentiality, integrity, and availability of personal data may require assessment under applicable data protection obligations.
There is a second risk that appears during outages. When the approved tool stops working, people reach for whatever does.
A receptionist under pressure may paste client details into a free chatbot to get replies out.
This introduces additional privacy and information security risks, particularly where the alternative tool has not been assessed or approved for processing that information.
An effective response should therefore consider both the immediate disruption and the risks introduced by temporary workarounds.
Seven Questions to Strengthen Your AI Incident and Continuity Planning
Businesses do not necessarily need separate AI-specific plans. Instead, they should review their existing incident response, business continuity, and disaster recovery plan arrangements to ensure AI-related risks and dependencies are appropriately addressed.
Which AI Tools Do You Actually Rely On?
List every AI tool in use, including AI features built into existing software. Ask each team, not just IT.
Identify the business owner, purpose, approved users, information processed and any dependencies on other systems or suppliers.
A simple approval register gives you a starting point and a record of what you found.
Which Ones Would Stop Work?
Assess the business impact of each AI tool becoming unavailable, producing incorrect outputs or performing an unauthorised action.
Identify critical business processes, acceptable disruption periods and recovery priorities. These should inform your business continuity and disaster recovery arrangements.
What Does the Team Do Instead?
Write the manual fallback for each critical process. Who answers enquiries? Which email templates do they use? What do you tell clients?
Also establish who employees report an AI incident to, who assesses its severity and who has authority to suspend the tool or activate alternative arrangements.
Keep it short enough to follow under pressure.
Do You Hold Your Own Copy?
Export anything you would struggle to rebuild. That includes client data, prompts, knowledge bases, templates and conversation records.
Where appropriate and technically possible, maintain recoverable copies of business-critical information in accordance with your retention, security and backup requirements.
Ensure that recovery arrangements are tested and that export information is appropriately protected.
What Does the Contract Say?
Check each critical supplier's terms for uptime commitments, how they notify you of incidents, how you get your data back if the contract ends or the company fails, and which other AI providers they rely on.
Consider the supplier’s incident notification arrangements, recovery commitments, subcontractors and data portability provisions.
Which Backup Tool Is Approved?
Choose an alternative before you need one. Assess whether the alternative provides sufficient operational independence from your primary provider, including any shared infrastructure or underlying service dependencies.
Tell staff what they can and cannot put into it.
Any alternative processing of personal data or confidential business information should undergo appropriate assessment and approval before use.
Have You Tested It?
Once a year, run a short tabletop exercise. Ask the team: "Our main AI tool has been down for four hours. What happens now?"
Extend the exercise to consider an AI tool disclosing personal information, producing incorrect customer communications or taking an unauthorised action.
Test whether employees know how to report the incident, who makes decisions, how essential services continue and what is required to restore normal operations.
The gaps show up quickly.
Would Your Business Know What to Do if an AI Incident Occurred Tomorrow?
If an AI tool your business relies on suddenly stopped working, disclosed customer information or began producing incorrect outputs, would your team know what to do?
For most businesses, the honest answer is "work it out as we go".
Effective AI governance means understanding where AI is used, the risks it introduces and how the organisation will respond when something goes wrong.
Incident response, business continuity and disaster recovery arrangements provide the structure to manage these situations, but they need to reflect how the business actually operates today..
Strengthening these arrangements does not necessarily require additional technology. It starts with understanding your business processes, establishing accountability, assessing dependencies and ensuring the people responsible know what actions to take.
If you would like a second pair of eyes on where AI sits in your current plans, Hyplon's governance consultancy work starts with exactly this kind of review. Book a 20 minute conversation with Marnie or Roger to find out where your business stands.
Frequently Asked Questions
What is an AI incident?
An AI incident is an event involving an AI system that causes, or has the potential to cause harm, disruption or unintended consequences. Examples include data exposure, unauthorised actions, incorrect outputs and service failures.
Should AI incidents be included in an existing Incident Response Plan?
Yes. Organisations should assess whether their existing incident response arrangements adequately address AI-related incidents, including reporting, escalation, containment, investigation and recovery.
What is the difference between incident response, business continuity, and disaster recovery plan, and where does AI fit?
Incident response focuses on identifying, assessing and managing incidents, including those involving AI systems. Business continuity focuses on maintaining essential operations when disruption occurs, such as an AI outage. Disaster recovery focuses on restoring affected technology, systems and data, including those supporting AI-enabled processes.
AI-related risks and dependencies should be considered across all three plans, with clear responsibilities and coordinated response and recovery arrangements.
Does UK GDPR require us to plan for AI incidents?
UK GDPR requires organisations to implement appropriate technical and organisational measures to protect personal data. Where AI systems process personal data, relevant risks should be considered within existing security, incident management and recovery arrangements.
How often do AI tools go down?
Often enough to plan for. The major AI services had several incidents in August and September 2026 alone, including a multi-provider outage on 3 September.
Where should a small business start?
Start by identifying the AI tools your business uses, the information they process and the business activities that depend on them. Then review whether your existing incident response, business continuity and disaster recovery arrangements adequately address the associated risk.