When an AI agent makes a bad media buy, remove its authority to commit further spend, secure the record of what it agreed, name one person to run the response and get a decision on the deal from whoever holds the budget. The template below sets out roles, steps and suggested timings, ready to copy.

TL;DR: An incident response plan for an AI buying agent has five stages: contain, secure the record, decide on the deal, notify and review. Each stage needs a named owner and a time limit agreed before anything goes wrong. The review ends with a decision on how much autonomy the agent gets back.

Liability is covered in Who Is Answerable When an AI Agent Makes a Bad Media Buy?, and the agent's records in What Should Buyers Be Able to See in an AI Buying Agent's Decision Log?

Why does an AI buying agent need its own incident response plan?

An AI buying agent can commit money faster than a person can notice, and there is no trader to ask what happened. Risk guidance already expects a prepared response: the NIST AI Risk Management Framework playbook (MANAGE 2.4) calls for mechanisms, with "responsibilities are assigned and understood", to "supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use".

"Every deliverable has an accountable human," Jonathan Whiteside, global EVP of technology at Dept, told Digiday in September 2026. "It's not an excuse to say, 'Oh, AI did it.'" A plan written in advance tells that accountable human what to do in the first hour.

What counts as an AI buying agent incident?

An incident is any event in which the agent commits, or nearly commits, the buyer to something the buyer would not have approved. Five types cover most cases, each with a different first question.

Out-of-mandate commitment. Terms outside the agent's written limits on price, inventory, audience or budget. First question: which mandate version applied?
In-mandate but wrong. The deal fits the mandate but not the brief. First question: what should the mandate have said?
Record mismatch. Buyer and seller hold different versions of the agreed terms. First question: what did both parties agree at the point of commitment?
Delivery mismatch. Delivery departs from the agreed terms on viewability, frequency or placement. First question: whose error is it?
Runaway activity. The agent repeats an action, loops on a negotiation or spends faster than planned. First question: is it still acting?

Near misses caught at an approval gate count too, because they show where the mandate is thin at no cost.

Record mismatches need particular care, because a decision log is only the buyer's own account. As one worked example, on the Alkimi Marketplace the terms are written to a DealSheet at the point of agreement, timestamped and held by both parties, so either side can retrieve the same terms independently. Whatever the venue, the plan should state in advance whether a shared record exists and where to find it.

Suggested severity levels

Severity 1: money committed outside the mandate, a live brand safety breach, or an agent still acting. Response starts immediately.
Severity 2: money committed inside the mandate but wrongly, or a disagreement with the seller on a material term. Response starts the same working day.
Severity 3: a near miss or minor delivery deviation. Reviewed at the next weekly check.

Who does what during an AI agent incident?

Six roles cover the response; on a small team one person can hold two. Keep incident lead and agent operator separate, because whoever configured the agent is a poor judge of its configuration.

Incident lead: runs the response, keeps the timeline, sets severity.
Budget owner: decides what happens to the deal and remaining spend. This is the person with commercial authority, not the day-to-day campaign manager.
Agent operator: changes the agent's permissions, exports its logs, applies agreed fixes.
Record keeper: secures the decision log, mandate version and agreed terms before anything is edited.
Counterparty contact: speaks to the publisher or seller.
Client or stakeholder lead: tells the client, brand team or finance what happened.

What should happen in the first hour?

The first hour is about stopping further damage and preserving evidence, in that order. Timings are suggestions for a Severity 1 incident.

Remove the authority to commit (suggested: within 15 minutes of detection). Move the agent down to recommending or drafting rather than switching it off, so it keeps logging. Revoke credentials only if it keeps acting.
Secure the record (suggested: within 30 minutes). Export the decision log, the mandate version, open offers and agreed terms to storage that neither the agent nor its vendor can edit.
Name the lead and set severity (suggested: within 60 minutes). One named person, written in the incident channel, with the time of the next check-in.

Klaudia Smykowska, group director at the agency Rise, told Digiday her team uses an audit log to spot agents drifting outside pre-set parameters: "I can make sure everything is recorded and that we can reconstruct what happened and why."

If a shared record of the deal exists, the record keeper retrieves it at this stage, before anyone negotiates a fix.

What should happen in the first day?

Once the agent is contained, the budget owner decides the deal's fate. Four outcomes are realistic, depending on the contract and the counterparty.

Proceed: let the deal run and record the variance against the mandate.
Amend: agree changed terms with the seller, recorded like the original.
Unwind: cancel by agreement, on the contract's cancellation terms.
Make good: accept delivery and agree compensating inventory.

Suggested timings: contact the counterparty before the decision is final, decide by the end of the working day, and tell the client within 24 hours even if the cause is unknown. The notice should state what happened, when it was detected, what is paused, what money is affected and when the next update will come.

What goes into the post-incident review?

The review establishes why the agent could do what it did and what changes to stop a repeat. Google's site reliability engineering book defines a postmortem as "a written record of an incident, its impact, the actions taken to mitigate or resolve it, the root cause(s), and the follow-up actions to prevent the incident from recurring" (Google SRE book, chapter 15). It argues for blameless reviews, because "you can't 'fix' people, but you can fix systems and processes".

For an agent, the system under review includes the mandate, data and approvals as well as the model. Betty Louie, partner and general counsel at The Brandtech Group, said at AdExchanger's Programmatic IO in September 2026 that AI products and workflows must be fully "auditable", both for training and for finding out why something went wrong (AdExchanger).

Suggested deadline: five working days. Fields to copy:

Timeline: detection, actions and decisions, timestamped from the logs rather than memory.
Impact: money committed, impressions delivered, brand safety exposure, client effect.
Type and severity: revised if the investigation changed them.
Mandate version: which applied and who approved it.
Approval gates: which were switched on. In the seller agent reference implementation for IAB Tech Lab's AAMP, for instance, approval is configured per flow, and where a gate is not enabled the recommendation "is applied automatically without operator review" (IAB Tech Lab seller agent documentation).
Root cause: agent behaviour, mandate gap, data input, counterparty error or human approval error.
Detection: how it was found and how long it ran. Discovery by chance means monitoring failed too.
Actions: each with an owner and due date.
Autonomy decision: the level at which the agent returns.

When should the agent get its autonomy back?

Autonomy should come back in steps, once there is evidence the cause is fixed, not on a timer. The earned autonomy ladder (Observe, Recommend, Draft, Human-approved action, Bounded automatic action), set out in What Is Earned Autonomy in Advertising?, gives the structure.

Suggested rule: return the agent at least one stage below where it was. Move it up only after the corrected mandate has been tested and a number of decisions, fixed in advance, have been reviewed without the fault recurring. After a Severity 1 incident, the budget owner signs off each step up.

Melissa Bonnick, EVP and head of programmatic at JPMorgan Chase, said at AdExchanger's Programmatic AI event in May 2026 (AdExchanger) that strong campaigns need not just a "human in the loop" but "a human in the lead".

How should a team rehearse the plan before it needs it?

A plan that has never been run is a document, not a capability. Google's SRE chapter notes that "it is important to define postmortem criteria before an incident occurs so that everyone knows when a postmortem is necessary", and the same holds for severity levels and timings.

A tabletop exercise (suggested length: one hour) picks an incident type, walks through the roles and timings, and notes every gap. A live rehearsal goes further by forcing an incident on purpose. The Alkimi Gym is one place to do that: buyers and sellers build their own agents, set the rules they work to and spar against counterparty agents before any real money moves, so a team's first incident need not be a live one.

Frequently asked questions

What is the first thing to do when an AI agent makes a bad media buy?

Remove the agent's authority to commit further spend while keeping it logging. Then secure the decision log, mandate version and agreed terms before anyone edits them.

Who decides whether to cancel an agent-negotiated deal?

The budget owner, the person with commercial authority over the campaign, makes the call. The counterparty has to agree to any cancellation or change.

How quickly should the client be told?

A suggested standard is within 24 hours of detection, even if the cause is not yet known. The notice should cover what happened, what is paused, what money is affected and when the next update will come.

Is an agent incident usually the agent's fault?

The cause is often a mandate gap or an approval gate that was switched off, not the model alone. A blameless review of the mandate, data and approvals finds the real fix more reliably.