Leading Through Incidents and Crises with AI

A crisis takes from a leader the thing the earlier chapters of this book have tried to protect: time to read the evidence before acting. This chapter asks what a leader does in the first hours of an incident that involves AI, or of a crisis in which AI is used to summarise, draft, translate and analyse, and how the leader keeps the three tests of the answerability principle, Name, Explain and Reach, when the clock is shorter than the briefing. It concerns L1 Orient, because a leader in a crisis works from a picture of the situation that someone or something else has assembled; L2 Decide, because the decisions are few, fast and often irreversible, and because the most important of them are decisions about who decides and who may stop; and L5 Answer, because the leader answers to supervisors on fixed clocks, to the management body or the council, to staff and their representatives, and to the people affected.

The chapter builds on conclusions of the earlier volumes and does not repeat their method. Stop decisions are named in advance (AI Governance, Chapter 13, F19), and the July 2026 OpenAI and Hugging Face incident failed through controls that were correlated, including an alert that reached people who did not hold the stop decision (AI Governance, Chapter 19, F28) (221, Nordqvist, 2026). Decision rights to stop, pause, deny or reverse are assigned before the crisis to holders who can act within the time the threat allows, and the right to stop must be cheaper to exercise than the right to continue (AI Threat, Chapter 30, F63) (224, Nordqvist, 2026). The stop right needs no approval and costs the organisation, not the individual, if it proves unnecessary (AI Blue, Chapter 18, F107) (227, Nordqvist, 2026). The stop path runs outside the system it stops, is timed and is drilled, and a stop in good faith is never a failure (AI Purple, Chapter 6, F121) (228, Nordqvist, 2026). Four rules about position keep the holders honest: the incident commander holds the incident by written, pre-assigned authority; an assistant never classifies or speaks externally; the stop right is held by roles that include one reachable out of hours without approval; and risk is accepted by named people with a compensating control and an expiry (AI Operations, Chapter 22, F149) (229, Nordqvist, 2026). This chapter takes the leader's side of those rules; incident command belongs to AI Operations, Chapters 14 and 22, and the security crisis to AI Blue, Chapters 18 and 19.

This book uses two words in a defined way. An incident is an event that the operating organisation handles with its own procedures: someone is declared incident commander, a runbook or a playbook is followed, a service is restored. A crisis is the state in which the incident, or an event that is not an incident at all, threatens the organisation's mandate, its licence to operate or the people it serves, and in which decisions are needed that no incident procedure is entitled to take: whether to suspend a service that residents or policyholders depend on, what to tell supervisors and the public before the cause is known, whether to accept a risk that a control owner has refused to accept. The distinction is the book's own working definition, chosen because the decision rights differ on either side of it: the incident commander holds the incident, and the crisis leader holds what the incident cannot hold.

Primary topics explored

1. What a crisis asks of a leader that an incident does not
2. The leader in the first hours
3. The stop right
4. Communication integrity
5. Answering to supervisors, regulators and the public
6. The crisis decision log