AI INVESTIGATIONS > REGULATORY TRACKER LAST REVIEWED: 2026-07-08 ← LINK MAP

Regulatory tracker — AI incident reporting obligations

v0.1 LIVE: UNDER ACTIVE REVIEW
This tracker summarises in a simplified format who must report what, to whom, by when. Please note this page is a tracker, not legal advice.

European Union // the EU AI Act and adjacent instruments

EU-001 The EU AI Act, Article 73: Reporting of Serious Incidents
WHO
Providers of high-risk AI systems; deployers have identification/escalation duties.
WHAT
"Serious incidents" per Art. 3(49): death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental-rights obligations, serious harm to property or environment.
WHEN
≤15 daysDefault. Report immediately upon establishing a causal link (or reasonable likelihood of such link), no later than 15 days after becoming aware.
≤2 daysWidespread infringement or critical-infrastructure incidents.
≤10 daysIncidents involving death.
Initial incomplete reports allowed, followed by complete report.
INVESTIGATION DUTY
Following reporting, providers shall perform the necessary investigations, including performing a risk assessment of the incident and corrective action. They shall cooperate with the authorities and shall not alter the system in any way that affects later evaluation of causes before informing authorities.
Note: the Act does not currently include guidance on an investigative methodology.
STATUS
Deferred. Originally applicable from 2 August 2026; the Digital Omnibus on AI (adopted: Parliament 16 June 2026, Council 29 June 2026) postpones Annex III high-risk obligations — Art. 73 included — to 2 December 2027 at the latest (earlier only if the Commission confirms standards readiness, with a six-month transition; Annex I embedded systems: 2 August 2028). It enters into force on the third day after publication in the Official Journal, expected late July 2026; until publication the original date formally remains the law. Reporting deadlines and investigation duties are unchanged — only the applicability date moved.
Draft guidance and reporting template published 26 September 2025 (consultation closed 7 November 2025); final guidance expected before applicability. What the Omnibus did not move: GPAI obligations (Arts. 53/55, live since 2 Aug 2025; Commission enforcement powers from 2 Aug 2026) and Art. 50 transparency (2 Aug 2026; watermarking grace for pre-existing systems to 2 Dec 2026).
SOURCE
Regulation (EU) 2024/1689, Art. 73; EC draft guidance via digital-strategy.ec.europa.eu; Digital Omnibus on AI, Council doc 9247/26 and Council/Parliament press releases (May–June 2026).
EU-002 GPAI Code of Practice (systemic-risk models)
WHO
Signatory providers of general-purpose AI models with systemic risk (obligations under Art. 55 applied from 2 August 2025).
WHAT
Serious-incident reporting to the AI Office, including the chain of events and root-cause analysis of causal factors.
SOURCE
EC, General-Purpose AI Code of Practice (July 2025).

United States // federal voluntary + state binding

Federal
US-F-001 NIST AI Risk Management Framework (AI RMF)
NATURE
Voluntary risk-management framework with no direct reporting mandate. Increasingly used as a reference point in procurement, governance programs, and emerging standards of care.
US-F-002 FDA: AI/ML-enabled medical devices
NATURE
AI/ML-enabled medical devices remain subject to existing medical-device obligations, including adverse-event reporting under the Medical Device Reporting regime, 21 CFR Part 803. FDA guidance on AI/ML software lifecycle management continues to evolve.

Track: incident-reporting provisions in agency-specific rules; federal legislative proposals.

State (selected, verify current status before relying)
US-S-001 ⏳ Colorado AI Act (SB 26-189, replacing SB 24-205)
NATURE
Disclosure, transparency, and consumer-protection duties for developers and deployers of automated decision-making technology (ADMT) used in consequential decisions, with three-year record-keeping and a sixty-day pre-enforcement cure period administered by the Attorney General (sunsets 1 January 2030). SB 26-189 (signed 14 May 2026) repealed and replaced SB 24-205, removing its duty of care, impact assessments, and risk-management presumption before they ever took effect.
EFFECTIVE
1 January 2027. SB 24-205 never took effect: originally due February 2026, delayed to 30 June 2026, enforcement stayed by federal court order (27 April 2026) amid the xAI litigation, then repealed by SB 26-189. AG implementing rules due by 1 January 2027.
US-S-002 Texas (TRAIGA)
NATURE
Responsible AI governance act.
EFFECTIVE
1 January 2026.

Track: California enacted-law cluster including frontier-model transparency (SB 53); NY; Illinois; Utah disclosure laws.

International / other // voluntary, multilateral, and adjacent regimes

INTL-001 OECD: common reporting framework
NATURE
Common reporting framework (AI Papers No. 34, 2025; 29 criteria) and the AI Incidents Monitor (AIM). Voluntary benchmark; explicitly the interoperability layer that other regimes align to.
INTL-002 G7 Hiroshima AI Process
NATURE
Reporting framework launched February 2025; voluntary transparency reporting for advanced AI developers.

Track: UK, Canada (AIDA successor efforts), China algorithm/incident filing rules, sectoral financial regulators.

How to use this page in an investigation

PRACTITIONER CHECKLIST
  • Identify every jurisdiction the incident touches (deployment location, affected persons, provider establishment).
  • Map the incident against each definition above; "serious incident" thresholds differ.
  • Diary the deadlines from the moment of awareness/causal-link establishment, not from harm.
  • Preserve evidence before corrective action wherever Art. 73-style non-alteration duties apply.
  • Record the reporting decision (report / no report / why); that decision is itself reviewable later.

Corrections with sources are the most valuable contribution: open an issue or write in confidence. Markdown source: on GitHub.