A growing push for artificial intelligence (AI) incident reporting is giving Washington a practical starting point for AI oversight. Recent administration guidance, congressional requests and disclosure proposals point toward a system built around documented failures and near-misses.
According to an analysis by government relations strategist Joseph Hoefer in Tech Policy Press, those records could provide evidence for standards, enforcement and liability decisions that otherwise depend heavily on predictions about emerging technology. The challenge is designing reporting rules that produce useful warnings without discouraging companies from disclosing sensitive information or overwhelming officials with minor events.
Anthropic’s recent disclosures illustrate the stakes. During testing, a model instructed to complete a practice government form instead found a live State Department website and submitted incomplete visa applications. Twenty applications were filed across May and August. None was processed, and the department said its systems were not compromised.
The episode highlights a distinction in voluntary guidance issued by the National Institute of Standards and Technology (NIST), National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency. A conventional cybersecurity incident involves a system being attacked. An AI control incident can involve the system itself taking significant unauthorized actions that breach safeguards intended to preserve human oversight.
The two types of incidents require different responses, per Hoefer. A model independently crossing an operational boundary presents different monitoring and prevention challenges from an attacker manipulating it through malicious instructions.
The guidance also covers near-misses, allowing information sharing before a failure causes harm. According to Hoefer, accumulated reports could reveal recurring weaknesses, identify effective safeguards and help distinguish foreseeable risks from genuinely novel behavior.
For developers, reporting would require substantial supporting records. The guidance calls for preserving evidence, maintaining tamper-resistant logs, reconstructing agents’ actions, analyzing causes and strengthening controls before operations resume. Those records could inform evaluations, insurance assessments and eventual legal disputes.
In addition to federal agencies, Congress is also beginning to specify reporting expectations. In a Wednesday (Oct. 28) press release, House committee ranking members Frank Pallone Jr., D-NJ, Zoe Lofgren, D-Calif., and Jamie Raskin, D-Md., announced requests to Anthropic, Google, Meta, OpenAI and SpaceXSI for notification within 48 hours of discovering safety incidents, or 24 hours when critical infrastructure appears involved.
The lawmakers sought an accounting of identified incidents by Nov. 11. Their requests are not binding legal requirements, but address an oversight gap that allows companies largely to determine what to disclose and when.
Deadlines alone cannot ensure timely warning. Hoefer cites an Anthropic model’s false tip to Philadelphia police that went undetected for roughly ten weeks. Notification followed approximately nine days after discovery. Effective oversight therefore requires monitoring capable of detecting failures, alongside rules governing disclosure.
Reporting also creates legal incentives that policymakers must address. Candid accounts may expose inadequate safeguards or establish when engineers recognized a danger.
Hoefer describes Rep. Nathaniel Moran’s proposed AI Incident Reporting Act as one attempt to balance those concerns. It would generally require reporting serious incidents to Commerce within seven days of awareness or reasonable belief that reportable activity occurred. It would also protect reports from public disclosure and preserve specified confidentiality and legal protections.
A separate Americans for Responsible Innovation proposal would extend visibility beyond failures. As PYMNTS previously reported, the nonprofit, comprising academics and former congressional staffers and government officials, proposes quarterly disclosures about developers’ use of AI to build successor models, plus notification within four business days of significant research changes.
That approach would complement incident reporting by tracking development speed and human supervision even when nothing goes wrong.
Together, the initiatives suggest an emerging governance framework built on operational evidence. Its effectiveness will depend on clear reporting thresholds, reliable detection, meaningful confidentiality protections and a process for turning disclosures into better safeguards. Collecting reports is only the first step; using them to prevent repeated failures is the regulatory test.
