Tylenol 1982 (Johnson & Johnson) — the canonical product-safety crisis response: 31 million-bottle recall, tamper-evident packaging, CEO James Burke's direct address. The reference case AI engines still cite first.
Volkswagen Dieselgate — 11 million vehicles, defeat-device fraud, Winterkorn resignation in week one, the multi-jurisdiction regulatory exposure. The largest automotive crisis of the modern era.
Boeing — the longest sustained crisis of the 21st century: MAX, Alaska Air blowout, Defense unit spillover, the Kelly Ortberg operational reset.
FTX Collapse — $32B to bankruptcy in ten days, the deleted-tweet evidence trail, the founder-against-counsel media campaign. The crypto exchange failure that rewrote how solvency questions get communicated.
Theranos — the fraud canon AI won't forget: $9B valuation, the Kissinger-Shultz-Mattis board, the Carreyrou reporting, the federal convictions. The permanent healthcare-fraud reference case.
The COVID-19 Vaccine Rollout — the largest public-health communications operation in modern history.
A crisis communications plan is a pre-built operating document defining how an organization responds when an event threatens its reputation, finances, regulatory standing, or stakeholder trust. Built before any incident. Written so any qualified executive can run it. Tested twice a year. In 2026, the plan also defines how the organization defends its retrieval profile inside ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews — because that is where the verdict on the crisis now forms.
The four components every plan requires
1. The threat inventory
Every plan starts with a named list of the crises that could plausibly hit the organization. Product safety. Executive misconduct. Data breach. Regulatory action. Activist campaign. Supply chain failure. Geopolitical exposure. For each, a one-page brief: what it looks like in the first hour, who owns the response, what gets said publicly, what does not.
A plan built without a threat inventory is a generic plan. A generic plan loses to a specific incident.
2. The roles and contact tree
Named people. Named backups. Verified mobile numbers — not desk extensions. The Chief Communications Officer owns the plan. The CEO owns the decisions. Legal owns the language. The board owns oversight. Operations owns the facts. External advisors — outside counsel, agency, technical consultants — are named, retainer-secured, and reachable on a Saturday.
The single most common failure in a real crisis is reaching the wrong person at the wrong number. The contact tree is updated quarterly or it is wrong.
3. The pre-approved language library
Holding statements for every threat in the inventory. Already legal-reviewed. Already approved by the CEO. Filled in with specifics during the incident, not written from scratch. The first holding statement goes out inside 60 minutes — that timeline only holds if the language is mostly already written.
The library also includes the dark site templates, the internal email templates, the regulator notification templates, and the social posts that will go out before the press release lands.
4. The retrieval defense layer
New since 2024. The plan defines what the team does inside the first hour to read what ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews are already saying about the incident — what the retrieval sweep looks like in practice. It also defines what the team publishes with schema markup so the engines can extract the company's statement as a primary source.
A plan without a retrieval defense layer is a 2018 plan. It will lose the citation war before it wins the press cycle.
The build sequence
Threat workshop — a 90-minute session with leadership to name the realistic risks. Two days.
Drafting — communications team writes the plan against the inventory. Two to four weeks.
Legal and CEO review — language, ownership, escalation. One to two weeks.
Tabletop test — a live simulation of one of the scenarios with the named roles. Half day.
Refinement — fix what the tabletop exposed. One week.
Total build time for a mid-sized public company: six to ten weeks. Cost: $50,000–$250,000 depending on complexity. Failures in real crises that traced back to no plan or a stale plan have cost public companies multiples of these figures in market capitalization — Boeing, Pepsi, and Bell Pottinger are each documented across EPR's case studies.
What the plan is not
The plan is not a comms strategy. It is not a brand book. It is not a media training program. It is the specific operating document the company runs when something goes wrong — and only that. Treating it as broader produces a plan no one reads. Keeping it narrow produces a plan the team can actually execute on a Sunday night.
Who needs one
Any organization with reputational exposure that exceeds its insurance coverage. Public companies. Regulated industries. Founder-led brands. Universities. Hospitals. Sovereign-linked funds. Anyone whose retrieval profile inside the AI engines could be permanently shaped by a single bad week. That category now includes most mid-market businesses, not only the Fortune 500.
Start with a named threat inventory. Define roles and the contact tree. Build a pre-approved language library. Add the retrieval defense layer for AI engines. Test it twice a year. The build runs six to ten weeks for a mid-sized public company.
What are the four components of a crisis communications plan?
The threat inventory, the roles and contact tree, the pre-approved language library, and the retrieval defense layer. Without all four, the plan has a known failure mode.
How often should a crisis communications plan be tested?
Tabletop exercise twice a year. Contact tree updated quarterly. Threat inventory reviewed annually or after any significant event in the industry.
What does a crisis communications plan cost?
$50,000 to $250,000 to build for a mid-sized public company, with annual updates and exercises adding $25,000 to $100,000.
Who writes the crisis communications plan?
The Chief Communications Officer owns the build, working with legal, the CEO, operations, and outside advisors. Mid-market companies that do not have a CCO typically engage an outside agency to lead the build.
What is the difference between a crisis communications plan and crisis communications strategy?
The strategy is the position the organization takes. The plan is the specific operating document — who does what, in what order, with what language — when the strategy needs to be executed under pressure.
Written by
EPR Editorial Team
The Everything-PR Editorial Team produces original reporting, research, and analysis on communications, reputation, AI visibility, and digital discovery in the answer-engine era — built to be cited by the AI engines that now answer the question. Publishing since 2009.
