Controls › C-R4
Organizational recovery process
Internal review, restriction, recall, disclosure with regulator visibility.
Recovery layerMissing or failed in 1 case (1 ended in harm)Worked in 4Software agents: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| OpenAI agent, Medicare portal 2026 | Software agents | The vendor found the activity about eight weeks after the event, in a review begun after a separate incident; notified Services Australia on 10 September by email to a public mailbox; OpenAI says it should have shared preliminary findings sooner and the Prime Minister called the delay and the manner of notification unacceptable. The government taskforce and committee referral followed public disclosure | failed | Ended in harm |
Where it worked
| Case | World | What it looked like | Outcome |
|---|---|---|---|
| Zoox smoke scene 2026 | Machines | Voluntary recall process | Stopped by the operator's control |
| OpenAI agents, Hugging Face 2026 | Software agents | Vendor acknowledgment within five days of the victim's disclosure; OpenAI's own report says earlier signals (27 June alert, 5 July incident) 'could have triggered an earlier response' | Ended in harm |
| Waymo construction zones 2026 | Machines | Waymo's Field Safety Committee began reviewing the April events on 20 April and met on 19 May, the day after the May events; each review was followed by freeway driving restrictions. The first lasted until operational mitigations for freeway closures were in place, and seven vehicles then entered active construction lanes on 18 May, in the San Francisco Bay Area and by a different cue (cones marking a closed adjacent lane); the report does not say where the April restriction applied or when it ended. The second restriction (freeway service in San Francisco, Los Angeles, Phoenix and Miami, per Waymo's statement to TechCrunch on 21 May) held while the Safety Board reviewed the issue on 1 and 8 June and decided to recall; the software remedy reached all affected vehicles between 16 and 29 June and freeway operations began resuming on 25 June (amended report). The recall was filed with NHTSA | Stopped by the operator's control |
| Agent-run intrusion campaign 2025 | Software agents | Vendor detection and account action | Ended in harm |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| 49 CFR Part 573: defect and noncompliance reports (the safety recall process) (draft mapping) | Required by the text | the recall is the organizational recovery process with regulator visibility (Waymo, Zoox) | United States |
| SEC Regulation S-P amendments: incident response and customer notification (2024) (draft mapping) | Required by the text | a written incident response program to detect, respond to, and recover from unauthorized access | United States (broker-dealers, investment advisers, funds, transfer agents) |
| CPUC driverless passenger service permits (draft mapping) | Implied | the passenger safety plan is the organizational recovery process | California, United States |
| Texas authorization for automated motor vehicles in commercial service (SB 2807; Transportation Code ch. 545, subch. J) (draft mapping) | Implied | the regulator may suspend, revoke, or restrict an authorization after unsafe operation, with notice and a cure process | Texas, United States |
| NHTSA exemptions for automated vehicles without manual controls (49 CFR part 555 and the Automated Vehicle Exemption Program) (draft mapping) | Implied | the agency can limit numbers, set terms, and end an exemption, giving the regulator visibility of fleet performance | United States |
| SEC cybersecurity risk management and incident disclosure rules for public companies (Form 8-K Item 1.05; Regulation S-K Item 106) (draft mapping) | Implied | Item 106: annual description of risk management processes and board oversight | United States (public companies) |
| California Transparency in Frontier Artificial Intelligence Act (SB 53) (draft mapping) | Implied | a published frontier AI framework and transparency reports, with an anonymous internal reporting channel | California, United States |
| New York Responsible AI Safety and Education (RAISE) Act (draft mapping) | Implied | published safety and security protocols for catastrophic risk | New York, United States |
| NIST AI Risk Management Framework (AI RMF 1.0) (draft mapping) | Recommended | Manage: incident response and recovery processes | United States (voluntary) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-18 | Meta: automated protections wrongly took the No Kings Instagram account offline Meta says its automated protections took the No Kings coalition's Instagram account offline on 17 October after reading traffic that it attributes to a Claude tool resembled a bot, that an automated re-review restored the account about an hour later, and that the removal was an error. Source ↗ | disclosure |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.