Examples
Examples from published documents
- A California report contains "(1) The date of the critical safety incident. (2) The reasons the incident qualifies as a critical safety incident. (3) A short and plain statement describing the critical safety incident. (4) Whether the incident was associated with internal use of a frontier model." (California SB 53, 22757.13(a))
- An EU initial report carries points (1) to (7) of Measure 9.2, from start and end dates to recommendations for the AI Office; the root cause analysis and post-market-monitoring patterns follow in later reports (EU GPAI Code of Practice, Safety and Security Chapter, Measures 9.2-9.3)
Counter-examples
Not to be confused with
- An incident report is not the incident: the incident is the event, the report is one filing about it, and one incident can have several reports.
- A developer's public blog post about an incident is a disclosure, not the regulatory report; California and New York keep the filed reports confidential.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Amended report
- Amended report is a follow-up incident report that California SB 53 and New York's RAISE Act allow a developer to file when it discovers information about a critical safety incident after filing its initial report.
- Source: California SB 53 (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025
- Intermediate report
- Intermediate report is the update the EU Code of Practice expects at least every four weeks for an unresolved serious incident, adding information to the initial report until a final report is filed within 60 days of resolution.
- Source: EU GPAI Code of Practice, Safety and Security Chapter
- Incident identifier
- Incident identifier is a single reference that links every report about the same incident so duplicates from different reporters can be merged. US Senate bill S. 5061, which has not been enacted, would have NIST develop processes for assigning one.
- Source: S. 5061 (119th Congress)
Source of record
Where this definition comes from
California SB 53 (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025, Cal. Bus. & Prof. Code 22757.13(a)
“"The Office of Emergency Services shall establish a mechanism to be used by a frontier developer or a member of the public to report a critical safety incident that includes all of the following: (1) The date of the critical safety incident. (2) The reasons the incident qualifies as a critical safety incident. (3) A short and plain statement describing the critical safety incident. (4) Whether the incident was associated with internal use of a frontier model."”
https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53EU GPAI Code of Practice, Safety and Security Chapter, Measure 9.2
“Signatories will report "at least the following information to the best of their knowledge": "(1) the start and end dates of the serious incident"; "(2) the resulting harm and the victim or affected group"; "(3) the chain of events"; "(4) the model involved"; "(5) a description of material available setting out the model's involvement"; "(6) what, if anything, the Signatory intends to do or has done in response"; "(7) what, if anything, the Signatory recommends the AI Office and, as applicable, national competent authorities to do"; "(8) a root cause analysis"; "(9) any patterns detected during post-market monitoring".”
https://ec.europa.eu/newsroom/dae/redirection/document/118119NY RAISE Act as replaced by S8828, Chapter 96 of the Laws of 2026 (N.Y. Gen. Bus. Law Art. 44-B), N.Y. Gen. Bus. Law 1422(1)
“"The office shall establish a mechanism to be used by a frontier developer or a member of the public to report a critical safety incident that includes all of the following: (a) the date of the critical safety incident; (b) the reasons the incident qualifies as a critical safety incident; (c) a short and plain statement describing the critical safety incident; and (d) whether the incident was associated with internal use of a frontier model."”
https://www.nysenate.gov/legislation/bills/2025/S8828
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| California SB 53Shadow mapping California SB 53 | “Four report fields (22757.13(a)); "A frontier developer that discovers information about a critical safety incident after filing the initial report required by this subdivision may file an amended report." (22757.13(c)(3))” | exactEQ confidence: high | California SB 53 (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 |
| New York (RAISE Act, S8828)Shadow mapping NY RAISE Act (Chapter 96 of the Laws of 2026) | “Same four fields (s.1422(1)); "A frontier developer that discovers information about a critical safety incident after filing the initial report required by this subdivision may file an amended report." (s.1422(3)(c))” In force 1 January 2027. | exactEQ confidence: high | NY RAISE Act as replaced by S8828, Chapter 96 of the Laws of 2026 (N.Y. Gen. Bus. Law Art. 44-B) |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Nine information fields (Measure 9.2); points (1) to (7) go "in an initial report", then "an intermediate report" at least every four weeks for unresolved incidents and "a final report, covering all the information required by Measure 9.2" (Measure 9.3). "If Signatories do not yet have certain relevant information from the preceding list, they will record that in their serious incident reports."” | exactEQ confidence: high | EU GPAI Code of Practice, Safety and Security Chapter |
| xAIShadow mapping xAI Frontier AI Framework, 30 June 2026 | “"When reportable under applicable laws and regulations, xAI will provide the relevant authorities with a copy of the incident report within the required deadlines" (s.3).” The FAIF26 PDF's own metadata /Title reads "Privileged/Confidential DRAFT working FRAMEWORK DOC"; no xAI statement disambiguating draft vs. final status was found. Treat as draft provenance until resolved. | closeCL confidence: medium | xAI Frontier AI Framework, 30 June 2026 |
| Frontier Model ForumShadow mapping Frontier Model Forum -- Information Sharing Issue Brief | “"Incident reporting refers to a formal notification submitted to a designated government body or authority that a qualifying AI safety or security incident has occurred."” Defines the act of reporting; prescribes no report fields. | closeCL confidence: medium | Frontier Model Forum -- Information Sharing Issue Brief |
| US Congress (S. 5061, 119th Congress, not enacted)Shadow mapping S. 5061, Sec. 4(a)(1) | “Voluntary sharing on "confirmed or suspected" incidents that shall "leverage, to the greatest extent possible, standardized disclosure and incident description formats" and "develop processes to associate reports pertaining to the same incident with a single incident identifier" (Sec. 4(a)(1)(A)-(B)).” S. 5061 is a bill introduced in the US Senate on 21 July 2026; it has not been enacted. | closeCL confidence: medium | S. 5061 (119th Congress) |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- UK AI Security Institute (AISI)
A government evaluator's published incident report with a companion "technical incident report"; a public write-up, not a regulatory filing.
UK AI Security Institute -- Incident Report: unsanctioned agent behaviour during cyber testing (4 Aug 2026) - EU
For high-risk AI systems, Art. 73(5) allows "an initial report that is incomplete, followed by a complete report" -- the same initial/final pattern in a different part of the Act.
EU AI Act (Regulation (EU) 2024/1689), Article 73
Divergence
Where sources materially disagree
California and New York ask for four short fields and allow amended reports; the EU Code of Practice asks for nine fields including a root cause analysis, split across initial, intermediate and final reports. The Frontier Model Forum warns that report timelines assuming root-cause analysis is already done produce "premature and unreliable reports", which is the tension the EU's staged reports address.
Gap
No regime publishes a machine-readable schema or a public identifier for incident reports; S. 5061 would require a single incident identifier but is not law.
