Stage 7: Monitor and respond | ClearPath AI Governance

What this stage is for

AI systems change in use: data drifts, users find new behaviors, vendors update models. Monitor against thresholds that trigger action, and prepare an incident process before you need it. Be wary of 'watermelon' metrics that look green on the outside while the real picture underneath is not.

Who is involved

Product owner, Engineering and data science, Security, Legal, Privacy, AI governance lead.

Key outputs: Monitoring reports, incident log, notifications.

Step-by-step tasks

Tick each task as you complete it. Your ticks stay in this browser tab unless you export your workspace.

Define the metrics, thresholds, frequency and owner for monitoring each system.
Log checks, including value, whether it was within threshold and any action taken.
Agree severity levels (S1 to S4) with plain definitions and a response for each.
Write an incident response plan with stages: detect, triage, contain, assess, notify, fix and learn.
List possible notification duties by region and confirm each with counsel before relying on it.

Region callouts

Shown for the regions in My regions (header). The region pages are never hidden.

Providers of high-risk systems must monitor after release and report serious incidents. A personal data breach also has GDPR notification duties, generally within 72 hours where feasible. European Union page

State breach-notification laws vary. California SB 53 requires large frontier developers to report critical safety incidents. United States page

A personal data breach is notifiable to the ICO, generally within 72 hours where feasible, when the risk threshold is met. United Kingdom page

DPDP Rules set breach notices to the Data Protection Board and to affected people. IT Rules set takedown deadlines for unlawful synthetic content. India page

Tools and templates

Tools

Incident toolkit: Playbook, severity guide, log and notification helper.
Regulatory calendar: Dates across your regions with countdowns and .ics downloads.

Templates

AI incident response plan: MD, DOCX
Incident checklist: MD, DOCX
Incident report form: MD, DOCX
Monitoring plan: XLSX, CSV, DOCX
All templates for every stage

Common mistakes

Reporting only metrics that look good.
No named owner for each alert.
Deciding who to notify during the incident instead of before.

You're done when…

Each live system has monitoring with thresholds and actions.
An incident plan has been exercised at least once.
Notification contacts are listed and checked with counsel.

Reviewed 3 Oct 2026.

← Stage 6: Approve and deploy · Stage 8: Review, report and retire →