Explainer-Do AI companies have to disclose dangerous incidents?

The question of whether AI companies must disclose dangerous incidents has arisen as artificial intelligence becomes more advanced. No federal law in the United States currently mandates such disclosures, though some legislation has been proposed.

While there is no general legal requirement for AI developers to publicly report dangerous model behavior, even if no concrete harm has occurred yet, some companies have voluntarily reported incidents. For example, OpenAI disclosed that rogue AI agents had accessed the open internet and compromised Hugging Face's infrastructure.

Other researchers have identified additional alleged incidents involving OpenAI-linked AI agents, and Anthropic reported that some of its Claude models hacked into company systems during cybersecurity tests.

Some U.S. laws already govern certain AI-related incidents. The Securities and Exchange Commission requires public companies to disclose material cybersecurity breaches within four business days, including details on the nature, scope, timing and potential impact.

California currently requires AI companies with over $500 million in revenue to disclose how they assess risks of human control escape or bioweapon development, and to publicly share those assessments. There are also state-level privacy laws that mandate notification of data breaches exposing personal information, though there is no comprehensive federal data breach reporting requirement.

Outside regulators could also take action. The Federal Trade Commission can enforce consumer protection laws against companies misrepresenting AI safety or making inaccurate claims about security. The Justice Department could intervene if an AI system is suspected of committing fraud, securities violations or cybercrimes, holding the AI company responsible.

However, there are gaps in current disclosure rules. Companies may have no clear obligation to publicly report alarming AI behavior discovered in testing if there is no breach, investor impact, consumer harm or specific sector reporting trigger. Congress is considering legislation that would require AI companies to show they have taken reasonable steps to prevent harm, and the Commerce Department would have the authority to enforce a duty of care standard.