Source versus conclusion
Keep source events, detector results, investigator notes, approvals, contradictions, and unknowns as distinct evidence layers.
AI incident evidence · reviewed August 24, 2026
Preserve the AI context. Keep the reporting decision human.
Endpoint, identity, cloud, network, and disk evidence still matter. KAIDAN adds source-attributed model, agent, tool, retrieval, gateway, guardrail, and custody metadata without treating a vendor verdict as proof of what happened.
What the AI incident record adds
Agent and tool chain
Record stable agent identity, MCP server, tool grant, handoff, observed outcome, collection time, and each source's visibility ceiling.
Portable integrity
Bind manifests, member digests, ledger links, signatures, and timestamp receipts so an authorized reviewer can check technical consistency outside Briard-AI.
Texas public-sector timing
Texas DIR says covered state agencies and local governments must report a qualifying security incident within 48 hours after discovery, or notify the secretary of state when election data is involved. DIR also states that incident details and a cause analysis are due within 10 days after eradication, closure, and recovery.
An event involving AI is not automatically reportable merely because AI was present. The affected entity and its authorized legal and incident leaders must apply the actual facts and governing law.
Read current DIR guidanceTechnical checklist
- Record occurrence, discovery, collection, decision, and submission times separately.
- Preserve the reporting confirmation and external incident ID.
- Keep the technical timeline separate from counsel's reporting determination.
- Track containment, eradication, recovery, notices, and cause analysis as distinct records.
- Keep prompts, response text, credentials, regulated content, and raw forensic images out of Briard-AI.
Primary sources and legal boundary
This material supports technical documentation. It is not legal advice and does not decide whether an event is reportable.