AI Incident Reporting Act

Key Points

• Companies that develop powerful AI systems would be required to report dangerous behaviors to the Secretary of Commerce within 7 days. This includes AI that tries to deceive people, evade shutdown, bypass safety controls, or gain unauthorized access to systems.
• The Department of Commerce has 180 days to write rules deciding which AI models and developers are powerful enough to be covered. The rules will focus on models that pose risks to national security or public safety.
• Reports are shielded from public disclosure and cannot be used as evidence in lawsuits or enforcement actions against the company that filed them. This is meant to encourage honest, timely reporting without fear of legal consequences.
• Reportable incidents include AI that could help create chemical, biological, radiological, nuclear, or explosive weapons, or that could accelerate offensive cyberattacks against critical infrastructure.
• Companies that fail to report covered incidents face civil penalties of up to $2 million per day of violation. The Secretary of Commerce can also investigate companies, issue subpoenas, and refer cases to the Attorney General.
• Near-miss events must also be reported, even if harm was ultimately avoided through luck or third-party intervention rather than the developer's own safety measures.