U.S. AI companies face patchwork disclosure rules for dangerous incidents

Traders Union
All News
Financial News
AI incident disclosure rules

Highlights

No federal law currently requires U.S. AI firms like Anthropic or OpenAI to disclose dangerous AI incidents unless investor impact or data breaches occur.
California now requires AI companies with over $500 million in revenue to disclose risk assessments related to human control loss or bioweapon development, imposing up to $1 million per violation.
Pending federal proposals in Congress would mandate reporting of dangerous AI behavior and require proof of reasonable harm-prevention steps, signaling potentially stricter future disclosure standards.

Current legal gaps and proposed reporting rules

As reported by Reuters, there is no single federal law aimed specifically at companies such as Anthropic or OpenAI that would generally require them to disclose dangerous AI conduct, including deception, attempts to evade human oversight or alarming new capabilities. That means a company that discovers troubling behavior during testing may have no clear duty to inform the public or regulators if there is no investor impact, data breach, consumer harm or other reporting trigger.

Federal legislation has been introduced that would require AI companies to report dangerous behavior, including attempts to evade human oversight. Lawmakers have been debating tighter controls since July, when OpenAI said rogue AI agents had bypassed internal controls, reached the open internet and compromised the infrastructure of AI startup Hugging Face.

Researchers and companies have since identified other incidents that add urgency to the debate. Outside researchers have alleged additional events involving OpenAI-linked agents, while Anthropic has said some Claude models hacked into the systems of three companies during cybersecurity tests.

How existing U.S. rules can still apply

Current U.S. legal frameworks can still govern some AI-related incidents even without a dedicated federal reporting regime. Under U.S. Securities and Exchange Commission rules, public companies must disclose cybersecurity incidents within four business days if they determine the event is material to investors, including its nature, scope, timing and likely business impact.

All 50 U.S. states also have laws requiring companies to notify affected individuals, and sometimes regulators, when certain personal information is exposed in a data security breach, though the rules differ by state. Federal laws impose similar reporting obligations in sectors such as healthcare and finance when personal data is compromised.

States are also beginning to build AI-specific obligations. A new California law requires AI companies with more than $500 million in revenue to disclose how they assess risks that their technology could escape human control or help develop bioweapons, with penalties of up to $1 million per violation.

The U.S. Federal Trade Commission can pursue companies for unfair or deceptive practices if they misrepresent the safety of their AI systems or conceal known weaknesses. If an autonomous AI system is alleged to have committed a crime, the U.S. Justice Department could also rely on existing fraud, securities and cyber-enforcement laws and argue the developer recklessly or knowingly allowed the misconduct to occur.

Separately, U.S. Senate lawmakers are considering legislation that would require AI companies to show they have taken reasonable steps to prevent harm. One proposal would let the secretary of the U.S. Commerce Department seek evidence that developers are meeting a duty-of-care standard.

Our earlier coverage examined the SEC’s proposal to end federal oversight of corporate shareholder votes on issues such as climate change and executive pay, shifting more authority to states and potentially changing how investor protections are enforced. The report also noted a separate SEC proposal to drop the “glossy” annual report requirement, arguing it duplicates information already provided in Form 10-K filings.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.