Incidents are now the norm, and the threat landscape is shifting. 

AI compresses attack timelines, lowers barriers to entry, raises first-attempt success rates, and elevates the supply chain as a significant source of breach exposure.

AI is enterprise infrastructure, and governance has to catch up.

Having a written AI governance framework is now a minimum requirement; what matters is whether it is operationalised, monitored and defensible

Organisations may be preparing for the wrong incident. 

Almost every organisation now has an incident response plan. What separates them is whether the plan rehearses the incidents they are actually likely to face, and whether the legal side of the response has been properly considered in advance.