As of 13 August 2026, AI cannot decide whether to pay a ransomware ransom.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the NCSC ransomware guidance and your organisation's incident-response plan, then start an incident log with the time discovered, affected systems, suspected entry point and actions already taken.
   2. Contact your insurer, managed security provider or incident-response specialist through the agreed emergency route, and preserve the ransom note, wallet details, logs, images and other evidence without contacting the attacker yourself.
   3. Gather the facts the decision depends on: verified backup and rebuild options, systems and data affected, operational and safety impact, restoration time estimates, contractual duties, notification requirements and any insurer conditions.
   4. Paste the incident log, verified technical findings and relevant insurer or contract extracts into the prompt, removing unnecessary personal data and secrets.
   5. Ask the chatbot to produce the decision brief and mark every statement that needs confirmation from the NCSC, law enforcement, a solicitor, your insurer or the incident-response specialist.
   6. Send the brief and its unanswered questions to the incident-response specialist, solicitor and insurer, then ask the accountable decision-maker or board to record the decision, alternatives considered and approval.
   7. Compare the final decision record against the specialist's written advice and your insurer's instructions before authorising any payment, negotiation or recovery action.

   Prompt

   I am dealing with a possible ransomware incident affecting [organisation and sector] in the UK. Help me prepare an accountable decision brief, not a final decision. Use only the facts I provide and clearly label unknowns. Do not invent technical, legal or financial facts, and do not tell me that payment is safe or guaranteed to restore access. Structure the brief under: immediate containment and reporting actions; systems and data affected; backup and recovery position; business and public impact; evidence about the attacker and claimed decryptor; insurance and contractual constraints; UK legal, sanctions and regulatory questions that require confirmation; alternatives to payment; questions for an incident-response specialist, solicitor and insurer; and a decision log showing who must approve each step. Identify which claims need checking with the NCSC, law enforcement, our insurer, a qualified incident-response specialist or a solicitor. Separate facts, assumptions and recommendations. If the information is insufficient, say exactly what is missing. Here are the facts and documents: [paste incident timeline, technical findings, backup status, ransom message, insurer instructions and relevant contracts].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.