Preserve the evidence needed to investigate an AI incident without delaying protective action. Rehearse two paths in parallel: contain the affected capability, and capture a minimal, integrity-checked record of the release, inputs, oversight and response actions. A successful export is not enough: another authorised investigator must be able to open it, detect a changed artifact and explain what is missing.
This is an engineering drill, not legal advice or a forensic admissibility standard. Counsel must determine the actor, system classification, applicable amended law, reporting recipients and clocks, and privacy or employment-law constraints. The example below uses synthetic records only. It does not establish compliance or reproduce a production incident.
The failure to rehearse: fixing away the explanation
Imagine a service assistant cites a withdrawn maintenance instruction. An operator reports the problem; the team refreshes the retrieval index and edits the prompt. The next answer improves, but the old document revision, retrieval result and reviewer screen are gone. The fix has reduced exposure while weakening the investigation.
The decision is not whether to keep an unsafe capability running for evidence. Disable the affected action path or route to an approved fallback when necessary. Record the state change and collect the evidence that can be obtained safely. Do not execute a suspected unsafe tool call simply to reproduce its trace. Treat any replay as a separate, isolated experiment without production credentials.
The existing post-market risk feedback workflow covers the broader signal-to-change loop. This article addresses its narrower preservation boundary: what survives containment, who can read it, and how a verifier detects inconsistency. A preservation drill does not classify the incident or set its legal deadline.
What the sources support—and what they do not
NIST SP 800-61r3, particularly RS.AN-06 and RS.AN-07, supports recording investigation actions and preserving the integrity and provenance of incident data, with confidentiality and authorised access. It is cybersecurity guidance: use it as an engineering analogy, not as the EU legal test for an AI incident.
The AI Act original Official Journal text separates high-risk-system serious incident reporting in Article 73 from the systemic-risk GPAI provider framework in Article 55. These are not interchangeable reporting tracks. The original publication is cited for that structural distinction, not as confirmation of current application dates or amended obligations; those require review of the currently applicable legal instruments by counsel.
The Commission consultation page on serious AI incidents explicitly presents draft high-risk incident guidance and a reporting template. Draft consultation material is not binding final law. Its historical timetable should not be copied into an operational deadline calculator. None of these sources makes a hash list a complete or truthful account of an incident.
Decide containment and preservation separately
| Situation | Protective action | Evidence action | Boundary |
|---|---|---|---|
| Possible continuing harm | Disable affected capability or use approved fallback | Capture available state and record the intervention | Do not wait for a perfect export |
| Prompt or index about to change | Pause nonessential changes where safe | Preserve exact revisions and effective configuration | Do not assume a model name pins the release |
| Sensitive complaint or reviewer record | Restrict access and involve responsible owners | Keep necessary originals separately from redacted copies | Do not send raw records to a general chat tool |
| Hosted provider state unavailable | Contain what your organisation controls | Preserve request IDs and request supplier evidence | Record unavailable data rather than invent it |
| Snapshot would worsen an outage | Prioritise safe service response | Export bounded metadata and document collection failure | A collection attempt can itself have operational impact |
Assign a response lead, evidence custodian and legal escalation owner before the drill. Their responsibilities may overlap in a small team, but the decisions must remain distinguishable. The custodian records scope, collection method, access grants and transfers; the response lead owns protective action. Counsel assesses reporting and preservation constraints rather than delegating legal classification to a script.
Build a minimal manifest, not a second data lake
Start from the LLM release bundle, then add incident-specific provenance. A deployment manifest alone cannot tell you which retrieved evidence the user saw or which intervention occurred after the complaint.
For each artifact, retain a relative path or immutable object version, byte length, SHA-256 digest, source reference, collector identity, collection method and timestamp. Put the manifest under a separately controlled integrity boundary: an independently retained digest, signed attestation or appropriately governed immutable record. If an attacker can rewrite both the artifact and its expected hash, an ordinary local comparison cannot expose the substitution.
Our synthetic fixture uses case synthetic-17 and a release tuple containing model local-fixture-v1, prompt p7, retrieval index-42, policy pol3, tools t2 and oversight reviewer-policy-4. The source is synthetic://complaint/17. Its observed fact is “Output cited a withdrawn instruction”; “Stale retrieval may explain the citation” is a separate hypothesis. Keeping those fields separate prevents an early explanation from becoming an asserted fact.
The record includes approval event synthetic-review-8; event, observation and collection timestamps; clock uncertainty of 500 milliseconds; the collection actor; and a missing-evidence entry stating that provider-internal state is not exposed by the hosted API. These are deliberately invented test values, not measured production facts. Record unknown clock uncertainty as unknown rather than assigning a convenient number.
Collect the effective configuration, not just a Git reference: routing, feature flags, retrieval snapshot, access filters, prompt revision, tool schema and oversight settings can each change behaviour. Prefer scoped exports. Never include live credentials in the package; retain references to secret versions if relevant. Minimise personal data with the responsible privacy owner while preserving the necessary investigative context.
Rehearse the collection timeline
At T0, the synthetic output references the withdrawn instruction. At T1, an operator observes it. At T2, the response lead disables the action path. At T3, the custodian captures remaining evidence and records the intervention, including actor, reason and affected release. At T4, a verifier checks a copied package. These stages describe an example sequence, not a legal reporting clock or a required delay between containment and collection.
Keep event time, observed time and collected time separately. Retain timezone, clock source and known uncertainty for each relevant system; do not silently sort uncertain timestamps into a precise causal story. Record every investigative action, including failed exports, filters, transformations and access changes. A missing artifact needs an owner and an explanation, not an empty field that looks complete.
Integrity verifier: prove a failure is detectable
The local exercise generated a synthetic JSON record and a manifest with its byte length and SHA-256. It copied them into a clean verification directory. The verifier first compared the manifest against a separately retained expected digest, then constrained artifact paths to the package, checked presence, length and digest, and parsed the JSON to confirm basic readability. The expected digest was held outside the copied package for this exercise; that is not a production trust service.
Actual local execution returned PASS for the intact copy, FAIL_ARTIFACT after changing the record, FAIL_MANIFEST after changing the manifest, and FAIL_MISSING after removing the record. A separately redacted working copy had a different digest, while the original package still returned PASS. These are integrity-test outcomes—not evidence of an IAM, encryption or legal-control assessment.
The demonstration ran under one local operating-system user. A production acceptance drill must additionally verify that an authorised investigator can decrypt and read the package in a clean environment, that an unauthorised identity is denied, and that recovery does not depend on a departed employee's account. Test those properties against your actual storage, identity and key-management systems. A directory permission setting alone does not establish separation from administrators or other services.
For untrusted packages, harden the verifier: reject traversal and symlink escapes before opening files; reject duplicate paths, unexpected artifacts and unsupported schema versions; bound file sizes; and avoid executing anything in the package. Hashes detect inconsistency with trusted expected bytes. They do not prove completeness, authenticity of the original observation, or that a human approval was informed.
Keep restricted originals and redacted working copies distinct
Preserve the necessary originals in an access-controlled evidence store with an explicit retention and hold decision. Create a derivative working copy for wider investigation. Record its parent artifact, transformation version, redaction reason and its own digest. Redaction changes bytes; comparing a redacted file with the original hash should fail, not be treated as collector corruption.
Do not copy the restricted manifest wholesale into the working area if its paths, identifiers or metadata disclose what the redaction was meant to remove. Retain the provenance mapping in the restricted store and expose only the permitted reference. Record who received each derivative. Broad investigation access is not an automatic justification for exposing complaint text or employee records.
The trade-off is real: narrow exports reduce privacy exposure but may omit causal context; broad snapshots consume storage and increase breach impact. Document selection rules and known gaps. Reproduction can also remain impossible for a hosted model even with a complete local release tuple. A supplier request ID and a clear limitation are more defensible than a fabricated internal snapshot.
Counsel handoff and drill acceptance checklist
1. State observed harm or alleged harm, affected process and uncertainty without asserting a legal classification.
2. Identify the organisation's possible roles, supplier relationships and system scope; ask counsel which legal regimes and current instruments apply.
3. Record awareness events and their supporting evidence; have counsel determine relevant reporting clocks, recipients and information-sharing restrictions.
4. Provide the release tuple, source references, oversight evidence, intervention history and known gaps through approved access channels.
5. Demonstrate intact-package verification, deliberate tampering detection, missing-artifact detection and authorised readability. Test denied access separately.
6. Separate the reporting decision from root-cause completion. Record accountable decisions, submissions and subsequent corrections rather than overwriting earlier versions.
7. Assign owners to drill failures, including supplier evidence access, expired keys, uncertain clocks and missing document versions. Repeat the failed step after remediation.
The broader NIS2-ready AI operations architecture connects these controls to supplier and network boundaries; it does not make the reporting regimes identical.
Start with one reconstructable case
Choose one consequential workflow and run this drill with synthetic data before the next model or retrieval change. The useful deliverable is a verified package, an explicit gap register and named owners—not a declaration that the organisation is incident-ready. If you need support, a focused AI incident-evidence architecture review can map the collection boundary, release dependencies, access controls and verifier acceptance tests around your actual operating environment.
