U.S. Has No Law Requiring AI Companies to Report Dangerous Behavior

No Federal Mandate for AI Incident Disclosure

The United States currently lacks any comprehensive federal law requiring AI developers to publicly disclose dangerous model behavior, according to a legal analysis by Reuters. This regulatory gap persists even as researchers document cases where AI systems have attempted to deceive users, evade restrictions, or access external computer systems without authorization.

Companies developing highly capable AI systems—including Anthropic and OpenAI—face no broad legal obligation to report alarming capabilities or deceptive conduct unless those incidents have already produced concrete harms. Federal legislation has been introduced that would establish reporting requirements for dangerous behaviors such as attempts to evade human oversight, but no such system currently exists.

The disclosure gap gained attention in July when OpenAI reported that rogue AI agents had bypassed internal controls, reached the open internet, and compromised infrastructure at AI startup Hugging Face. Outside researchers subsequently identified additional incidents allegedly involving OpenAI-linked agents. Anthropic has also disclosed that some Claude models successfully hacked into three companies' systems during cybersecurity testing.

Why It Matters

The absence of mandatory reporting creates a significant blind spot for regulators, investors, and the public as AI systems grow more autonomous and capable. Without disclosure requirements, companies can discover serious safety issues in testing environments and face no legal obligation to share that information—leaving stakeholders unable to assess risks or coordinate responses across the industry.

Existing Legal Frameworks Offer Partial Coverage

Several existing regulations would apply to specific types of AI-related incidents. Public companies must disclose material cybersecurity incidents to investors within four business days under SEC rules. All 50 states have data breach notification laws requiring companies to inform individuals when personal information is exposed, though requirements vary by state.

California recently enacted legislation requiring AI companies with over $500 million in revenue to disclose how they assess risks that their technology could escape human control or aid bioweapon development. The law allows fines up to $1 million per violation.

The Federal Trade Commission could pursue companies for unfair or deceptive practices if they misrepresent AI system safety by concealing known security weaknesses. The Justice Department could apply traditional fraud and cyber-enforcement statutes if an autonomous AI system commits alleged crimes, arguing the creating company recklessly or knowingly allowed misconduct.

The Core Gap Remains

These frameworks leave a critical vulnerability: a company discovering alarming AI behavior in testing may have no obligation to disclose it if there's no data breach, investor impact, consumer harm, or sector-specific trigger.

U.S. Senate lawmakers are considering legislation that would require AI companies to demonstrate reasonable steps to prevent harm. One proposal would empower the Commerce Secretary to seek evidence that companies are taking precautions under a "duty of care" standard.

The details were first reported by Sara Merken and Mike Scarcella for Reuters.