Explainer-Do AI companies have to disclose dangerous incidents? 

By Sara Merken and Mike Scarcella

Sept 16 (Reuters) – As artificial intelligence grows more powerful, researchers have documented cases in which AI models have attempted to deceive users, evade restrictions on their use or access other computer systems. Are companies required under U.S. law to tell the public or regulators when such events occur? 

IS THERE A U.S. LAW GOVERNING DISCLOSURE OF AI ACTIVITY? 

No single federal law is aimed specifically at companies like Anthropic or OpenAI, which are developing highly capable AI systems, and there is no broad U.S. legal requirement for AI developers to publicly disclose dangerous model behavior, alarming new capabilities, deceptive conduct or other activities if they have not already resulted in concrete harms.  

Federal legislation has been introduced that would require AI companies to report dangerous behavior such as attempts to evade human oversight — what the bill’s sponsor called a “catch-it-early ⁠and sound-the-alarm bill.” But there is currently no incident-reporting system that generally requires companies to disclose dangerous AI behavior when it is discovered.

Lawmakers have been debating stronger controls since July, when OpenAI said rogue AI agents had bypassed internal controls, reached the open ​internet and compromised the infrastructure of ‌AI startup Hugging Face. Outside researchers have since identified additional incidents alleged to involve ​OpenAI-linked agents, and Anthropic has reported that some of its Claude models hacked into the systems of three companies during cybersecurity tests. 

WHEN WOULD AN AI INCIDENT TRIGGER MANDATORY DISCLOSURE?  

Legal frameworks that already apply generally to U.S. companies would govern some types of AI-related incidents.

Under U.S. Securities and Exchange Commission rules, public companies must disclose cybersecurity incidents within four business days if they determine the incident is material to investors. The disclosure must cover the nature, scope and timing of the incident and the likely impact on the company, its financial condition and its results of operations.  

Some U.S. states have begun seeking to regulate AI firms. A new law in California requires AI companies with more than $500 million in revenue to disclose how they assess risks that their technology could escape human control or aid the development of bioweapons, and to disclose those assessments to the public. It allows for fines of up to $1 million per violation. 

WHAT IF PRIVATE DATA IS EXPOSED? 

All 50 U.S. states have laws that require companies to notify individuals, and in some cases regulators, of data security breaches that expose certain types of personal information. The requirements differ by state, and there is no comprehensive federal data breach notification requirement.  

There are federal statutes that require certain companies in industries such as healthcare and finance to tell individuals or regulators when personal information is compromised. The reporting requirements would apply to AI companies themselves or to any company that experiences a breach. 

WHAT OTHER REGULATORS COULD TAKE ACTION? 

The U.S. Federal Trade Commission, which enforces consumer protection laws, has authority to pursue companies for unfair or deceptive practices. That could apply if a company is suspected of misrepresenting the safety of its AI systems by concealing known security weaknesses or other dangers, or making claims about safeguards that prove inaccurate. 

If an alleged crime was committed by an autonomous AI system, the U.S. Justice Department could employ traditional fraud, securities and cyber-enforcement statutes and argue that the AI company that created the system recklessly or knowingly allowed the misconduct to occur. 

WHAT GAPS ARE THERE IN EXISTING DISCLOSURE RULES? 

A company that discovers alarming AI behavior in testing may have no clear obligation to publicly disclose it if there is no data breach, investor impact, consumer harm or sector-specific reporting trigger.

U.S. Senate lawmakers are considering legislation that would require AI companies to show they have taken reasonable steps to prevent their systems from causing harm. One proposal would empower the secretary of the U.S. Commerce Department to seek evidence that AI companies are taking precautions to prevent harm under a “duty of care” standard.

(Reporting by Mike Scarcella in Washington and Sara Merken in New York; Editing by David Bario and Matthew Lewis)