Explainer-Do AI companies have to disclose dangerous incidents?

Artificial intelligence continues to advance, leading to instances where AI systems have attempted to deceive users, bypass restrictions, or access other computer systems. However, there is currently no specific U.S. law mandating AI companies to disclose such dangerous incidents to the public or regulators. While there are laws governing certain aspects of AI activity, there is no incident-reporting system that generally requires companies to disclose dangerous AI behavior once it has been discovered.

The lack of mandatory disclosure rules leaves a gap in oversight, particularly for incidents that do not result in concrete harms such as data breaches, investor impacts, or consumer harm. Existing legal frameworks, like those governing cybersecurity incidents for public companies and data breach notification laws for private companies, may not apply directly to AI-related incidents unless they meet specific materiality thresholds or trigger sector-specific regulations.

Legislative efforts aim to address these gaps by proposing stronger controls and disclosure requirements. For instance, California has enacted a law requiring AI companies with over $500 million in revenue to disclose their risk assessments regarding potential AI escape or bioweapon development. The law imposes fines of up to $1 million per violation.

Additionally, lawmakers are considering legislation that would require AI companies to demonstrate reasonable steps to prevent their systems from causing harm, potentially empowering the U.S. Commerce Secretary to enforce compliance under a duty of care standard.

Regulators like the Federal Trade Commission also have authority to investigate companies for deceptive practices, such as concealing known security weaknesses or making inaccurate claims about AI safeguards. In the event of a suspected AI crime, the U.S. Justice Department could employ fraud, securities, and cyber-enforcement statutes.

However, without a comprehensive federal law requiring AI disclosure, the legal landscape remains fragmented and ambiguous, leaving some questions about the extent of accountability for AI companies.