Ask AI to prepare, compare, summarise, retrieve, and challenge information.
This guidance is for BCM professionals, for managers and governance owners who oversee BCM work, and for the people in resilience, risk, crisis management, IT, security, facilities and operations who work beside BCM teams.
This guidance is about how AI can help BCM professionals draft, analyse, review, communicate, maintain and validate their work. It does not cover the resilience of AI systems, or of services that depend on AI. That is a different topic.
- BCM professionals
- Managers and governance owners
- Resilience, risk, crisis management,
IT, security, facilities
Introduction
AI assists BCM managers with written tasks at each of the six stages. For instance, during the 'Govern and Embed' stages, it drafts policy wording from your approved framework for review and adapts awareness messages for each audience. During the Analyse and Design stages, it prepares business impact analysis (BIA) interview guides and questions the assumptions behind the strategies. During the implementation and validation stages, it drafts plans, writes exercise scenarios and categorises debriefing notes into actions.
The brain in a jar
Imagine the language model (LLM) is a brain in a jar. On its own, it can only read what you paste into the chat box and generate a response. Its usefulness depends entirely on the questions you ask and the context you provide. What you connect it to determines its capabilities.
Where do I stand?
First, work out which of the four things you are currently using.
Every important action should be approved by a knowledgeable individual. Results can only be compared if the inputs are controlled, the method is documented and the output is verified. A workflow is the fastest way to achieve this.
The five AI maturity levels
Five rising levels, Ad hoc to Optimising, with most teams at levels 1 to 2 and the aim at levels 3 and 4.
The rules that always apply
At every AI maturity level and in every stage of your BCM lifecycle, these five principles apply:
-
Know AI and its limits
-
Match the tool to the classification
-
Checking AI output and approving what it does
-
AI answers only from approved sources, and cites them
-
Quality over impressing
AI across the BCM lifecycle
AI assists BCM managers with written tasks at each of the six stages.
Not sure which stage your task is in? Ask the AI4BCM Guidance chatbot.
1 Govern
- A simple workflow monitors approved official sources and prepares a short note on their relevance for you
- Grounded drafting. Use an enterprise AI assistant alongside approved internal documents to create a first draft of a policy, scope statement or governance note
Show more ↓Show less ↑
- Red-team review. Ask the AI to identify any clauses that are unclear, unrealistic, inconsistent or ambiguous
- Onboarding support. A dedicated internal assistant helps new practitioners to understand the structure, terminology and expected outputs, based on approved BCMS governance material
- Structured management reporting. Use AI to summarise BCMS metrics, open actions, validation results and review data for management
Much of this stage is drafting, reviewing and summarising, and AI does that well.
ClearBank, a UK clearing bank, uses generative AI to check its internal policies against each other so that key policies do not fall out of line; this is described by the bank in a UK government collection of case studies (2024), not reported as a result.
2 Embed
- Anonymised feedback analysis. Use a corporate AI or analytics tool to group survey comments into themes such as 'confusion', 'ownership gaps', 'confidence', and 'positive examples'
- Simplification and translation. Use AI to convert formal business continuity language into shorter, clearer wording or into other languages used within the organisation
Show more ↓Show less ↑
- Current case-study creation. Search-enabled AI can help you to identify recent public incidents that are relevant to your sector. You must verify the facts before use
- Audience-specific message drafting. Ask the AI to explain a business continuity topic to executives, line managers, site managers and support staff in plain language and in a specified format
- Internal chatbot support. A virtual assistant can answer routine questions such as where to find a plan, what a person's business continuity role involves, and why an exercise is important. However, it must be based only on approved content
Much of this stage is explaining, adapting messages for each audience and reading feedback, and AI does that well.
Fairfax County’s 911 call centre in Virginia collaborated with George Mason University to build an AI voicebot that plays the caller in practice scenarios for new and experienced call-takers. The university reports this as a tested prototype for 2025, not reported as a result.
3 Analyse
- BIA interview support. Use an enterprise AI assistant to prepare interview guides and workshop questions, explain definitions, and structure the expected outputs of the discussion
- Consistency checking across responses. Ask the AI to compare BIA outputs from related departments and identify where one team's assumptions or recovery expectations conflict with another's
Show more ↓Show less ↑
- Dependency mapping. Compare activities with systems, people, suppliers, sites and data to identify shared dependencies, single points of failure and areas of concentration risk
- Recovery target review support. Use AI to test whether a proposed RTO is consistent with impact thresholds, dependencies, and comparable activities
- Continuous review workflows. A workflow tool monitors changes in approved source systems and flags any potentially affected BIA or risk assessment records for human review
AI can structure interviews, summarise workshops, spot inconsistencies and dependencies, and compare data sets. It can also flag records for review when something changes.
The US Defense Logistics Agency uses AI risk-assessment models to identify unreliable suppliers and those providing counterfeit or non-conforming parts (2025).
4 Design
- Structured gap analysis. Ask the AI to compare the required recovery outcomes and critical dependencies with the current arrangements, and to identify any gaps, assumptions or missing information
- Generate a long list by resource type. Prompt the AI to suggest possible continuity strategies categorised by area, such as the workplace, staff, technology, suppliers, inventory, records, logistics and process workarounds
Show more ↓Show less ↑
- Solution red-teaming. Ask the AI to act as a reviewer and identify how a proposed solution could fail in the event of a real disruption, taking into account hidden assumptions and shared dependency risks
- Horizon scanning workflows. Use workflow and search-enabled AI to produce regular updates on relevant developments in recovery technology or service models
- Business case drafting support. Use AI to summarise structured option data and create a concise comparison paper for management
AI compares options, shows gaps between what you have and what you need, challenges assumptions and organises the facts for a decision.
The US Army Materiel Command contracted AI mapping and monitoring of its multi-tier supply chains to see where vulnerabilities sit and where alternative sources are viable; this was announced at contract award in 2025, not reported as a result.
5 Implement
- Template-grounded plan drafting. Give the AI the approved plan structure and ask for concise, directive wording that identifies any missing information, rather than making assumptions to fill the gaps
- Role-based action card generation. Ask the AI to extract the actions relevant to a named role, timeframe or scenario from the controlled plan
Show more ↓Show less ↑
- Cross-plan consistency review. Use AI-based retrieval to compare strategic, tactical, departmental and technical plans for contradictory roles, activation thresholds, communication routes and escalation logic
- Draft communications support. Use AI to prepare holding statements and staff messages for likely disruption scenarios before any incident occurs
Much of this stage is writing, updating and comparing plans, and AI does that well.
The UK Government Communication Service used its own generative AI tool to draft and evaluate crisis communication plans for 17 government departments (2024).
6 Validate
- Scenario and inject generation. Ask the AI to provide a scenario package tailored to the exercise type, sector, participants and learning objectives. This package should include timed injects and facilitator guidance
- Controlled role-play support. Use AI to generate realistic external messages from regulators, customers, suppliers, the media or partners, all of which are subject to facilitator control
Show more ↓Show less ↑
- Debriefing and hot debriefing summarisation. Structure post-exercise or post-incident discussions around the following areas: strengths, weaknesses, issues, actions and unresolved questions
- Cross-event lessons analysis. Ask AI to analyse the results of several exercises or incidents and identify any patterns that could suggest underlying capability gaps
- Audit and evidence gap scanning. Use AI-based retrieval to compare current BCMS documents and records with internal checklists or approved requirement summaries, flagging any missing evidence for human review
AI can write exercise scenarios, play external parties, summarise debriefs, group lessons identified and compare results across events. It can also prepare material for management review or audit.
Fayette County Public Schools in Georgia run virtual tabletop exercises on cyber and physical incidents for their leaders with custom AI assistants (2025).
Prompts that work
Four steps: pick the task, write the prompt, check the output, make it repeatable.
- 1 Pick the task
- 2 Write the prompt
- 3 Check the output
- 4 Make it repeatable
Which task first?
Pick a task where all four answers are yes.
- Do you do it at least once a month?
- Is it a task you would rather not do?
- Could you explain the steps to a new colleague in a few minutes?
- Will a person still review and approve the result, and can the work carry on without the tool?
Ask the AI4BCM Guidance chatbot which task to pick. This will help you identify which section of the guide covers it.
The prompt pattern
- Role
- BCM analyst [context], working on [the larger task] for [who will use the output].
- Task
- [one narrow, clear task].
- Sources
- the attached material only, as evidence about the organisation. Use no facts or figures from general knowledge.
- Output
- [the structure you want, for example an executive summary, then one section per site].
- Gaps
- anything the sources do not answer. Do not guess it; list it here. Also list any source that is a draft or out of date.
- Cite
- document and section for each point. Put copied words in quotation marks.
For even better output
Make it repeatable
Level 2 · Repeatable
Share your prompt with your team
A prompt becomes a team asset when it is saved and given a version number, an owner and a named reviewer. Before the team relies on it, run it on three past cases for which you know the correct answer.
Level 3 · Defined
Build your own skill
A skill is a saved prompt that makes the results more consistent.
How to write a good prompt, further reading
Anthropic: Prompt engineering OpenAI: Prompt engineeringRead it in the guide →
Copy them →