Holding Statement Prompts: What to Say Before You Have Facts
The hardest document in crisis comms — and the one every template library gets half right.
The five things that matter
- Templates give you words. The decision is a concession. “We take this extremely seriously” concedes it’s serious. That may be right — but choose it, don’t inherit it from a template.
- Draft three, not one. Minimum, standard and maximum disclosure. It gives counsel a real choice instead of one draft to redline.
- Speed applies to acknowledgement, not explanation. Fast “we’re aware” is nearly always safe. Fast “here’s what happened” is how retractions happen.
- The insurance clause almost nobody mentions. Liability policies commonly contain cooperation clauses under which admitting liability without insurer consent can prejudice coverage. Wording is a coverage question, not just a PR one.
- Pre-write the next three statements before releasing this one. If your holding statement isn’t consistent with every plausible outcome, it’s already a problem.
Something has broken and you need words in the next hour — or you’re building a crisis plan and want the statement library done before you need it.
You haven’t classified the incident yet. Run the [[first-hour assessment]] first — a holding statement written before triage will either over-concede or say nothing at all.
On this page
Why this is the hardest document in crisis comms
Every other crisis document has the luxury of facts. A full statement explains. An apology accounts. A regulatory notification reports. The holding statement has to do meaningful work with nothing — say something real, at the moment you know least, in words that will still be defensible after you know everything.
And it has to fail in neither of two directions:
| Failure | What it sounds like | Cost |
|---|---|---|
| Says nothing | “We are aware of reports and have no further comment at this time.” | Reads as evasion. Cedes the narrative — others fill the space, and their version becomes the record. |
| Says too much | “We believe this affected a small number of accounts and was caused by a third-party issue.” | Two unverified claims. When either changes, the correction becomes the story — and it’s now about your credibility. |
The interesting part is that most template libraries solve the first problem and cause the second. They hand you polished, empathetic, reassuring language — “we take the safety of our customers extremely seriously,” “we are conducting a full and thorough investigation,” “we will provide updates as soon as possible” — and every one of those phrases is a commitment. Seriousness conceded. Investigation promised. Timeline implied. You may want all three. But you should have chosen them.
A holding statement isn’t a writing problem. It’s a concession problem wearing a writing problem’s clothes.
Which is precisely why AI is useful here — not for the prose, which is easy, but for making the concessions visible before you commit to them.
The five components — and the five forbiddens
Every workable holding statement contains some subset of five components. Which ones you include is the disclosure decision.
Component 1 alone is a valid statement. Components 1 and 4 are the practical minimum for a press enquiry. Adding 2 and 3 is where most of the disclosure decision lives.
And the five that must never appear
| Never include | Because |
|---|---|
| An unconfirmed cause | “Caused by a third-party vendor” is an accusation if wrong and an admission if the vendor was yours to manage. Cause comes after investigation, never before. |
| A number | Scale figures in hour one are almost always wrong, and they only ever revise upward in public perception. “A small number of” is a number. |
| Blame — including your own | Accepting fault has legal, insurance and regulatory consequences that are not a comms decision to make. |
| An unverified deadline | “We’ll update within 24 hours” is a promise you now have to keep, on someone else’s timetable. Say “as soon as we’re able to” unless the deadline is confirmed internally. |
| A characterisation of severity | Calling it “a minor issue” ages catastrophically. Calling it “a serious incident” concedes seriousness before you know. Describe, don’t grade. |
The three disclosure levels and what each concedes
This is the framework the prompt is built on. Three levels, ascending. Each buys more goodwill and costs more optionality.
| Level | Contains | Concedes | Use when |
|---|---|---|---|
| 1 — Acknowledge | Awareness + contact route | Only that something is happening worth acknowledging. | Unverified allegation · disputed facts · legal exposure high · you genuinely know almost nothing |
| 2 — Acknowledge + Act | Awareness + action + contact | That it warrants investigation — i.e. it isn’t trivial and isn’t obviously false. | The default. Something real has happened, cause unclear, no confirmed harm to named parties. |
| 3 — Acknowledge + Act + Impact | All five components, including concern for affected people | That people were affected, and implicitly that this is your event rather than something happening near you. | Harm is confirmed and visible · withholding sympathy would itself be the story |
Prompt 1: The three-variant generator
This is the flagship. It produces all three levels plus the ledger, so the decision presented to your CEO and counsel is a choice between costed options rather than a single draft.
## ROLE You are assisting a communications team drafting a holding statement under uncertainty. Your value is not the prose — it is making the concessions in each version explicit before we commit to one. ## ORGANISATION Who we are: [NAME, SECTOR, WHAT WE DO IN ONE LINE] Audience for this statement: [Press / customers / employees / all of the above] Our normal register: [Formal / plain / warm. Paste 2–3 lines of our existing public writing so the voice matches.] Legal exposure: [High / medium / low / unknown — and why] Is an insurance claim plausible? [Yes / no / unknown] ## THE SITUATION CONFIRMED (verified against a record or document): [ONLY things we have actually verified. If this list is empty, say so — it changes what we can write.] REPORTED BUT UNVERIFIED: [What's being alleged or said, and by whom] WHAT WE DO NOT KNOW: [Be explicit. Cause, scale, whether anyone is affected.] Has anyone been harmed? [Confirmed yes / confirmed no / unknown — this changes everything below] Where will this appear: [Press response / website / social / customer email / all] Named contact route: [Role, email or phone — or "none yet"] ## PRODUCE THREE VARIANTS **LEVEL 1 — ACKNOWLEDGE.** Awareness and contact route only. Minimum viable. Should be defensible even if the allegation turns out to be entirely false. **LEVEL 2 — ACKNOWLEDGE + ACT.** Adds what we are doing, in present tense, without characterising what we'll find. **LEVEL 3 — ACKNOWLEDGE + ACT + IMPACT.** Adds concern for those affected. CRITICAL: express sympathy WITHOUT accepting causation. Flag explicitly if the situation as described makes this distinction impossible to hold. Each variant: 40–90 words, publishable as written. ## THEN, FOR EACH VARIANT, THE LEDGER - CONCEDES: what a reader can fairly infer we have accepted. - FORECLOSES: what position this makes harder to take later. - INVITES: the first follow-up question a competent journalist asks after reading it. - WEAKEST PHRASE: the single wording most likely to be quoted back at us, quoted exactly. ## FINALLY - YOUR RECOMMENDATION and why, in two sentences. - WHAT WOULD CHANGE IT: the one fact that, if we learned it in the next hour, would move us up or down a level. - FOR COUNSEL: the specific wording choices a lawyer should rule on, listed as questions. ## RULES - Use ONLY information given above. If a variant needs a detail I have not supplied, write [PLACEHOLDER] — never invent a figure, cause, name or timeline. - No unconfirmed cause, no scale estimate, no blame, no deadline I have not given you, no severity grading. - Avoid "we take this extremely seriously" unless you flag what it concedes. It is not neutral. - Do not tell me this is legal advice or that it is cleared. It is neither.
Worked example: all three variants, with the ledger
A regional healthcare provider. A local news outlet has contacted them about claims from an anonymous source that patient records were accessible without authentication for an unknown period. IT is investigating and has confirmed nothing. Deadline: 4pm.
CONFIRMED: a journalist contacted us at 11:40 with this claim and a 4pm deadline. Our IT team has begun a review.
REPORTED, UNVERIFIED: that records were accessible without authentication. Source is anonymous and we don’t know who.
DO NOT KNOW: whether it’s true, how long, how many records, whether anyone accessed anything, whether it’s still open.
HARM: unknown. Legal exposure: high — regulated health data. Insurance claim plausible: yes.
Concedes: that an enquiry was made and is being treated as a priority. Nothing about whether the claim has substance.
Forecloses: very little. Survives the claim being false.
Invites: “Are you saying the claim is untrue?”
Weakest phrase: “as a priority” — implies urgency and therefore plausibility. Defensible, but it isn’t free.
Concedes: that the claim is credible enough to investigate, and that patient data protection is your obligation — which is true and unavoidable in a regulated sector.
Forecloses: the “this is baseless” position. You’ve now treated it as worth a technical review.
Invites: “When will the review conclude, and will you notify affected patients?”
Weakest phrase: “once the review allows us to speak accurately” — soft, but it does promise a further statement. Keep it only if you’ll honour it.
Concedes: that there is something to be concerned about, and — via “anyone affected” — that there may be affected people. That’s a meaningful step toward accepting the incident is real.
Forecloses: any later position that this was a non-event.
Invites: “How many are affected, and when will they be contacted?” You have no answer to either yet.
Weakest phrase: “we’re sorry that this uncertainty exists” — carefully built to apologise for the uncertainty rather than the incident, but a plaintiff’s lawyer will still put it in front of a jury. Counsel must rule on this line specifically.
Recommendation: Level 2. The claim is unverified and anonymously sourced, so Level 3’s sympathy language concedes reality the facts don’t yet support. But Level 1 in a regulated health context reads as stonewalling, and stonewalling is itself a story when patient data is involved.
What would change it: if the technical review confirms records were exposed, move to Level 3 immediately and notify. If IT confirms authentication was never bypassable, hold at Level 1 and prepare a rebuttal.
For counsel — rule on these four:
- Does “we’re sorry that this uncertainty exists” risk being characterised as an admission under our policy’s cooperation clause?
- Does “protecting patient information is a core obligation” create a standard we’re later measured against?
- Does any variant here start or affect a regulatory notification clock?
- Does “we will contact anyone affected directly” commit us beyond what the applicable notification rules require?
Note what the ledger produced that a template couldn’t. Three publishable drafts is the cheap part. The valuable output is question 1 — that the most humane sentence in Level 3 is also the one your insurer may care about most. Nobody catches that at 11:50am on deadline without a structured prompt to force it.
Prompt 2: The concession audit
Run this on any statement you didn’t generate yourself — the version legal sent back, the one the CEO rewrote, the one from your existing crisis plan.
Audit the draft statement below. Do not rewrite it unless I ask. Assume it is about to be published permanently. THE DRAFT: [PASTE IT] WHAT WE ACTUALLY KNOW: [CONFIRMED FACTS ONLY] WHAT WE DO NOT KNOW: [THE GAPS] Produce: 1. CLAIM-BY-CLAIM. Every factual or implied claim in the draft, each labelled SUPPORTED (we know it), UNSUPPORTED (we don't), or IMPLIED (not stated but a reader will infer it). Implied claims are the ones that cause trouble. 2. THE CONCESSION LIST. What does this admit? Include the admissions the writer probably didn't intend — causation implied by sympathy language, standards implied by commitments, severity implied by tone. 3. THE COMMITMENT LIST. Every promise, explicit or implied. Investigations, updates, contact, remedies. For each, note what happens if we fail to deliver it. 4. THE FIVE FORBIDDENS CHECK. Flag any unconfirmed cause, scale figure, assignment of blame, unverified deadline, or severity characterisation. 5. THE QUOTE. The single sentence most likely to be extracted and used against us. Quote it exactly and say who would use it: a journalist, a regulator, or a plaintiff's lawyer. 6. THE CONTEXT-STRIPPED TEST. This statement will be indexed and retrieved by AI search engines and quoted without its surroundings. Read it as a standalone fragment. Does it still mean what we intend? If not, say which part breaks. 7. THE MINIMUM EDIT. The smallest change that removes the largest exposure, and what it costs us in warmth or credibility. Be honest about the trade. Do not soften your analysis. I need the objections now, not from a journalist at 4pm.
Prompt 3: Channel adaptation and consistency check
The substance must be identical everywhere; the format can’t be. Inconsistency between your press statement and your tweet is trivially easy to spot and reliably becomes a second story.
APPROVED STATEMENT: [PASTE THE CLEARED VERSION] CHANNELS WE NEED: [Press response / website notice / social post / customer email / internal note / holding line for phones] For each channel produce a version that: - changes NO fact, NO commitment, NO characterisation - adapts only length, format and practical detail - stays recognisably the same statement if placed side by side Then, critically: A. THE DRIFT CHECK. List every difference between versions and confirm each is format-only. Flag any that alters meaning, however slightly. B. THE SCREENSHOT TEST. Assume every version is screenshotted and posted next to the others. Does any pairing look inconsistent, evasive, or like we told groups different things? C. THE INTERNAL LEAK ASSUMPTION. The internal note WILL reach outside — assume this. Does it contain anything that contradicts, undercuts or embarrasses the external one? D. THE PHONE LINE VERSION. What the person answering calls says out loud, in spoken English, plus the two things they must NOT be drawn into saying. Do not add information to any version.
Point D is chronically neglected. Organisations approve a beautiful written statement and leave whoever answers the phone to improvise. That person is now your spokesperson, unbriefed, in real time.
Prompt 4: The questions this invites
Every statement generates the next round. Run this before release, not after the calls start.
THE STATEMENT: [PASTE] WHAT WE KNOW / DON'T KNOW: [PASTE] WHO WILL ASK: [Trade press / national press / customers / employees / regulator / investors] 1. THE TEN QUESTIONS this statement invites, ordered by how likely they are and how badly we handle them. Phrase each the way the asker would actually phrase it, including the hostile phrasings. 2. FOR EACH: can we answer it now? Mark ANSWERABLE, NOT YET, or NEVER (legally or commercially off-limits). 3. THE THREE WE CANNOT ANSWER AND WILL DEFINITELY BE ASKED. For each, draft a response that declines without sounding evasive — an honest reason for not answering yet beats "no comment" in almost every case. 4. THE QUESTION WE ARE HOPING NOBODY ASKS. Name it. This is the point of the exercise. 5. THE TRAP QUESTION. The one where any answer is damaging — typically a "so are you saying X" construction. Identify it and note how to reframe rather than answer. No drafting of new statements. This is preparation.
Level-up: pre-write the next three statements
This is the part competitors won’t have, and it’s the discipline that separates managed crises from reactive ones.
A holding statement is not a standalone document — it’s the first move in a sequence, and it should be consistent with every plausible ending. Generating those endings used to be too expensive to bother with. It isn’t any more.
We are about to release the holding statement below. Before we do, model the three branches it has to survive. THE HOLDING STATEMENT: [PASTE] THE OPEN QUESTIONS: [WHAT THE INVESTIGATION WILL RESOLVE] TIMEFRAME: [WHEN WE EXPECT TO KNOW MORE] Draft the NEXT statement for each of three branches: **BRANCH A — CONFIRMED WORSE.** The facts come back and it's more serious than the holding statement implied. Draft the follow-up. Then answer the critical question: does anything in the holding statement make this branch harder to write? Quote the specific phrase that would look bad in hindsight. **BRANCH B — CONFIRMED BETTER.** The claim was wrong, or the scope was far smaller. Draft the follow-up. Then: does the holding statement over-concede such that this correction looks defensive or self-serving? Can we credibly walk back from what we already said? **BRANCH C — STILL UNKNOWN IN 48 HOURS.** The most common branch and the least prepared for. Draft a second holding statement that says something new without having anything new to say. Then: what does the holding statement commit us to that we now cannot deliver on time? Then output: 1. THE COMMON PHRASE. Wording that works in all three branches. Prefer this in the holding statement. 2. THE BRANCH-BREAKER. The phrase in our current draft that works in one branch and damages us in another. This is the highest-value edit available to us right now. 3. THE TRIGGER MAP. For each branch, what specifically tells us we're in it, and who decides. 4. THE 48-HOUR OWNER. Who is responsible for issuing the Branch C statement if nothing has changed, and by when. Name a role. Branch C fails through nobody owning it. RULES: - Do not invent facts for any branch. Use conditional framing and [PLACEHOLDERS] throughout. - All three drafts require legal review before use.
Item 2 is what you’re actually paying for. There is almost always one phrase — usually the warmest, most reassuring one — that reads beautifully if things turn out fine and disastrously if they don’t. Finding it before release costs ten minutes. Finding it afterwards costs considerably more.
Your holding statement is now a primary source. The first 72 hours don’t just shape coverage — they build the citation record AI engines retrieve for the next 18 months.
Which adds a drafting requirement crisis comms never had before: it has to survive being quoted without context, because that is increasingly how it will be encountered. If a sentence only reads correctly with the rest of the statement around it, rewrite the sentence.
The legal and insurance constraint
This is the section most holding statement guides skip, and it’s the one with the largest financial consequences.
Sympathy and fault are not the same thing
Legal frameworks in a number of jurisdictions distinguish between a partial apology — an expression of regret, sympathy or a benevolent gesture that stops short of accepting fault — and a full apology that admits fault. Where apology protections exist, they commonly cover only the first kind. Some provisions deem a protected apology not to be an admission of liability; others merely limit its admissibility in court. The scope varies considerably by jurisdiction.
Practically, that’s the difference between “we’re sorry this happened to you” and “we’re sorry we caused this.” Under deadline pressure that distinction erodes fast, which is why the concession ledger belongs in the prompt.
The cooperation clause is the sharper risk
And note: legislation preventing insurers from denying claims on the basis of an apology exists, but is exceedingly rare. Do not assume apology protection extends to your policy.
What this means in practice: where a claim is plausible, statement wording is a coverage question, not only a reputational one. Your broker or insurer may need to see the language. Add that to the crisis plan now, because at 3pm on deadline day nobody will think of it.
The three clocks
Practitioners describe a three-clock model — legal, organisational and media timelines — where credibility depends on aligning them rather than letting one dominate. The failure modes are symmetrical: comms alone produces a fast statement legal can’t live with; legal alone produces silence the media fills. The holding statement exists precisely to buy the legal clock time without ceding the media one.
What AI must never do here
| Never | Why |
|---|---|
| Supply a fact you didn’t give it | A model filling a gap with a plausible figure or cause produces a fabricated claim in a legal document. Every prompt here says use placeholders. Keep that instruction in. |
| Decide the disclosure level | It can cost the options. Choosing between them is a leadership and legal call involving exposure it cannot see. |
| Assess your insurance position | Coverage turns on policy wording and jurisdiction. AI prepares the question; your broker and counsel answer it. |
| Tell you it’s cleared | No output here is publishable as generated. Legal review is a step, not a formality. |
| Hold privileged material | Don’t paste counsel’s advice, investigation findings or regulator correspondence into a consumer tool. Use an enterprise tier with appropriate data terms — decided in advance, not mid-crisis. |
| Judge whether the claim is true | It has no access to your systems, records or people. Verification is human work against evidence. |
Which model, and one setup note
Use a reasoning-tier model for the ledger and the escalation ladder — both reward careful analysis, and the extra seconds are irrelevant against a deadline measured in hours. Any competent model can produce the prose; the concession analysis is where capability shows.
The setup step worth doing today: run the three-variant prompt now, in peacetime, across your five most plausible incident types. Get the outputs reviewed by counsel while nobody is under pressure, and put the approved versions in the crisis plan. A pre-cleared statement you only have to fill in beats a brilliant one you’re drafting at 3pm — and the review is the slow part, not the writing.
Model behaviour, apology legislation and disclosure obligations all change. We re-verify on each review cycle; confirm your own position with counsel regardless.
Common questions
What is a holding statement?
A holding statement is a short, pre-cleared public statement issued early in an incident, when an organisation knows something has happened but does not yet know the full facts. Its job is narrow: to confirm awareness, show the matter is being taken seriously, and direct enquiries to a named contact, without admitting fault, speculating about cause, or committing to conclusions the organisation cannot yet support.
What should you say when you do not have the facts yet?
Say what is verifiably true and nothing else. That usually means three things: that you are aware of the situation, that you are establishing the facts, and where enquiries should go. You can add an expression of concern for anyone affected without accepting responsibility for causing it. What you must not do is estimate scale, name a cause, assign blame, or promise a timeline you have not confirmed you can meet.
Does apologising in a holding statement admit liability?
It depends entirely on which kind of apology. An expression of sympathy or regret that stops short of accepting fault is generally treated differently from a full apology that admits fault, and many apology protection laws cover only the first kind. The more serious risk is contractual rather than evidential: liability policies commonly include cooperation clauses under which admitting or assuming liability without the insurer’s consent can prejudice or void coverage. Clear the wording with counsel and, where a claim is plausible, with your insurer.
How quickly should a holding statement be issued?
Common practice is within the first hour of becoming aware, and research on crisis response has found that a quick early response generates greater perceived credibility than a slow one. That said, speed applies to acknowledgement rather than to explanation. A fast statement that confirms awareness and nothing more is almost always safe. A fast statement that explains what happened, before you know, is how organisations end up retracting.
What should never go in a holding statement?
Five things: a cause you have not confirmed, a number you cannot stand behind, an assignment of blame to any party including yourself, a deadline you have not verified internally, and any characterisation of the seriousness of the incident. Each of these is a hostage to fortune, and each is routinely included by organisations trying to sound helpful in the first hour.
Should the same holding statement go on every channel?
The substance must be identical everywhere, because differences between versions become the story and are trivially easy for journalists to spot. Format can adapt to the channel, so a social post may be shorter than a press statement and an internal note may carry additional practical instruction. What cannot change is any fact, any commitment, or any characterisation. Anything written for internal audiences should be assumed to reach external ones.
Can AI write a holding statement?
It can draft variants and, more usefully, analyse what each variant concedes, which is the part humans consistently get wrong under time pressure. It cannot decide how much to concede, cannot assess your legal or insurance exposure, and must never introduce a detail you did not give it. Treat every output as a draft for legal review. An invented figure or unverified cause in a crisis statement is a legal event, not an editing error.
What is the difference between a holding statement and a full statement?
A holding statement is issued under uncertainty and deliberately withholds explanation because the explanation is not yet known. A full statement is issued once facts are established and does the opposite: it explains, accounts, and where appropriate accepts responsibility. Confusing the two is the most common failure. Organisations either issue a full statement too early, on facts that later change, or stay in holding-statement mode long after they know enough to say more, which reads as evasion.
Download: The Holding Statement Library
All three disclosure levels, pre-drafted across eight crisis types — with the concession ledger for each, so you know what you’re choosing.
◦ Product safety or recall
◦ Workplace incident or injury
◦ Executive misconduct allegation
◦ Financial irregularity
◦ Service outage or failure
◦ Discrimination or harassment claim
◦ Supply chain or partner failure
Send me the statement library →
24 pre-drafted statements plus the counsel question list. Unsubscribe anytime.
Read next
About this guide
Narracomm is a communications and content strategy team. We build and test prompt systems inside live client work and revise them as models, legislation and conditions change. [REQUIRED BEFORE PUBLISHING: named reviewer with genuine crisis or legal experience — a former agency crisis lead, in-house comms director, or a lawyer who has advised on incident response — with credential and review date shown. This page discusses wording with legal and insurance consequences, which makes review non-negotiable.]
Sources & further reading
- Corporate apologies: balancing crisis management, liability defense and insurance recovery — on cooperation clauses and insurer consent
- ADRAC — apologies in civil liability claims — partial vs full apology protection
- Institute for Public Relations — Crisis Management and Communications — response speed and credibility research
- Pagefield — what are holding statements in crisis communications
- Workshop — 11 examples of holding statements
- Caliber — crisis communication strategies — the three-clock model
Scope: this guide is general information about communications process. It is not legal advice, does not interpret your insurance policy, and must not delay safety response or professional counsel. Apology protections, disclosure obligations and policy terms vary by jurisdiction and contract — verify yours with a qualified lawyer. Last reviewed: August 5, 2026 · Next review due within 14 days.
