A compromised account, exposed customer records or an AI agent acting beyond its authority can raise immediate questions about responsibility and harm. The organisation needs to respond while important facts remain uncertain. The work begins with the decisions that cannot wait and the evidence needed to make them. Sources reviewed 23 October 2026.
Identify the decisions that cannot wait.
NIST’s incident-response guidance addresses legal involvement, supplier contracts and the preservation of incident data and its provenance. It is technical guidance, not Swiss law. NIST: Incident Response Recommendations, SP 800-61 Revision 3
Establish who can direct the response, what is known and which decisions are urgent. These may include restricting access, preserving records, notifying an insurer or authority, and communicating with affected people. Record when relevant facts became known and why each decision was taken. An incomplete account should remain visibly incomplete.
Legal and technical work need to proceed together. Responders may need to contain an attack or restore a service while counsel assesses obligations and potential proceedings. Coordinate changes so that relevant evidence is preserved where practicable. Identify who will collect it, the authority for access and the safeguards needed. Technical recovery can continue while responsibility and the full extent of harm are still being investigated.
Assess the personal-data breach separately.
The FDPIC’s Article 24 FADP guidelines distinguish notification to the authority, the processor’s duty to inform its controller, and information to affected people. FDPIC: Data security breaches and notification guidelines
Under Swiss data-protection law, the controller must notify the FDPIC as quickly as possible where a personal-data breach is likely to create a high risk to the personality or fundamental rights of affected people. A processor must inform its controller of a breach without applying that same risk threshold. Informing affected individuals is a separate obligation where their protection requires it or the FDPIC requests it.
Examine the information involved, who may have accessed it and the possible consequences for people. A preliminary assessment may require action before an investigation is complete. Record the reasoning, provide further information as it becomes available and revisit the assessment when the facts change.
Map the other duties and potential disputes.
The NCSC explains the reporting regime for qualifying cyberattacks on critical infrastructure, including its scope and the relationship with other authorities. NCSC: Cyberattack reporting obligations — FAQ
Swiss critical-infrastructure rules can require a cyberattack report independently of a personal-data breach. Whether they apply depends on the organisation and the incident. Sector requirements, foreign rules and contractual duties may require separate assessments. Do not assume that a report to one recipient fulfils every obligation.
Review the operative contracts and insurance terms alongside the facts. Which services were promised? What notice, cooperation or evidence does the agreement require? Who controlled the affected system? Preserve the basis for possible claims and defences, including causation and loss. A supplier’s involvement does not itself establish liability, and an incident report should distinguish verified facts from allegations and provisional explanations.
Reconstruct what the AI system actually did.
NIST’s Generative AI Profile addresses unreliable outputs, privacy, harmful bias and supplier dependencies. It recommends incident records, version history and change management; the evidence approach here applies those ideas to legal investigation. NIST: Generative Artificial Intelligence Profile, AI 600-1
AI may be the subject of an investigation: confidential information disclosed through a tool, an adverse automated decision, misleading generated material or an agent taking an unauthorised action. Establish the actual behaviour and its consequences before assigning responsibility.
Where relevant and lawfully available, preserve prompts, retrieved information, outputs, logs, configuration, model versions and provider changes. For an agent, examine permissions, approvals and actual tool actions. Reconstruct what people saw and authorised at the time. A later attempt to reproduce an output may involve a different system or context. Identify unavailable records and the limits they place on any conclusion.
Use AI to assist a fair inquiry.
The FDPIC confirms that Swiss data-protection law applies to AI-supported processing, including requirements concerning transparency, automated decisions and high-risk processing. FDPIC: AI and data protection
AI can also assist the investigation itself by organising documents, proposing chronologies and identifying material for review. Define the permitted sources, purpose and environment before using it. Assess confidentiality, employee rights, access restrictions and any transfer of information to providers.
Check important propositions against original records and test competing explanations. Review samples of material excluded by automated selection. Prepare interviews around the evidence and give people an appropriate opportunity to explain matters affecting them. Generated summaries are working aids; they do not establish a person’s intention, credibility or responsibility.
Make the findings useful for the next decision.
Agree the investigation’s mandate, reporting line and intended use. A preliminary decision brief, a report to a board and material prepared for proceedings serve different purposes. Assess confidentiality and any available legal protections for the particular engagement and jurisdiction.
The report should explain what is established, what remains uncertain and which evidence supports each material finding. Connect those findings to options: further inquiry, notification, a claim or defence, settlement, or remedial action. Assign responsibility for agreed changes and a way to check their effect. The organisation should retain a usable record of the facts, decisions and reasons.