US lawmaker proposes AI Incident Reporting Act to force early disclosure of dangerous AI incidents

The AI Incident Reporting Act introduced by Texas Republican Nathaniel Moran would mandate that AI model developers report dangerous capabilities, security breaches, and safety incidents to the U.S. Commerce Department within seven days of discovery. For the most serious incidents, the Commerce Department would need to notify Congress within 48 hours.

What happened

Moran described the legislation as "a catch-it-early and sound-the-alarm bill" in an interview about the AI Incident Reporting Act. The bill targets specific reportable activities: models attempting to evade human oversight, circumvent safeguards, undermine operator control, unauthorized access to model weights, and threats to public safety including chemical, biological, and nuclear risks.

The proposal follows the Commerce Department's action against Anthropic's latest models on national security grounds, which resulted in Anthropic disabling access globally. That move exposed the absence of a transparent framework to govern frontier AI.

Moran's approach contrasts with broader efforts like the Great American Artificial Intelligence Act, which also included incident reporting but is more sweeping. He argues a targeted bill could gain bipartisan support more quickly as Congress has struggled to pass AI legislation amid debates over innovation, competition with China, and preemption of state laws.

Why AI builders should care

For teams building and deploying frontier AI models, this bill introduces a clear compliance timeline and specific categories of reportable behavior. If enacted, developers would need internal systems to detect and document dangerous activities within a seven-day window. Incident reporting could become a standard operational requirement, similar to data breach notification laws.

Mark Beall, president of the AI Policy Network, noted growing public demand for action on AI safety, suggesting momentum for targeted regulation could translate into law faster than broader proposals.

Practical implications

Developers would need to build monitoring and logging capabilities to identify incidents such as model weight theft, evasion of safeguards, or public safety threats. The seven-day reporting deadline demands rapid triage and documentation processes. The 48-hour notification to Congress for serious incidents means executive teams must have escalation paths ready.

This sits alongside other regulatory efforts, including the Illinois AI safety law requiring third-party audits for companies like OpenAI and Anthropic. The landscape increasingly points to mandatory reporting and oversight for frontier models.

Caveats

The bill is a proposal and details may change before any potential passage or enactment. Congress remains divided on AI regulation, and the timeline for this bill is uncertain. Broader debates over state preemption and international competitiveness could affect its trajectory. The scope of affected companies and precise definitions of "dangerous capabilities" will need clarification as the legislative process moves forward.