The first hour.
An incident lands late in the afternoon. Is it reportable? Should the service be shut down? Who talks to customers? Everyone in the room is capable, and everyone is looking at someone else.
Under NIS2, an early warning for a significant incident is due within 24 hours. The clock doesn't wait for your organisation chart.
Mandates, not just playbooks.
Most companies have an incident plan. Fewer have settled who can make each specific decision, who stands in when that person can't be reached, and what they can do without asking anyone.
Agree that in advance. Write it down. Rehearse it. Then the question in the room moves from "who decides?" to "what do we decide?"
Know what stops.
Preparation also means knowing what depends on what. If this supplier goes down, which services stop, and which customer promises are affected? That picture is hard to draw during an incident and easy to use if it already exists.
Keep the record while it happens.
During a crisis, the AI can keep the timeline, gather facts and draft reports for a person to approve. The people running the crisis keep their attention on the crisis. Afterwards, each decision is there: who made it, when, and on what they knew at the time. That last part matters. Hindsight is much less fair than a good record.