The Form Is Downstream of the Threshold
H.R. 9477, the introduced AI Incident Reporting Act, asks a question that sounds administrative but is really constitutional for the system it proposes: when must an AI model developer tell the federal government that something important has happened? The focus here is the decision that comes before the report form—how the law would define the covered models, covered developers, and reportable activity. That distinction gives readers a practical way to judge whether an incident-reporting regime can see the risks it names, rather than merely whether it has a complete-looking form.
The useful conclusion is simple but easy to miss: reporting starts with a boundary. Someone must decide which systems are inside the regime, which signals count, how much evidence is enough to act, and what happens when the harm is still developing. A form can record those decisions. It cannot make them.
H.R. 9477 is a proposed boundary-setting system
H.R. 9477 was introduced in the House on June 25, 2026, and referred to the Committee on Energy and Commerce. Its short title is the AI Incident Reporting Act. Those procedural facts matter. The text is a first-party legislative proposal, not an enacted requirement, an operating agency program, or a finalized set of regulations. Describing what the Act “would” require is therefore not a cautious stylistic choice; it is the legally accurate description of its status.
The bill would put the Secretary of Commerce at the center of the proposed architecture. Within 180 days after enactment, the Secretary would consult relevant agencies, model developers, private-sector entities, and technical, cybersecurity, national-security, public-safety, and other experts. The Secretary would then establish capability or other thresholds for models and developers that could pose significant risks to national security or public safety. Those thresholds would determine which models and developers become “covered” for the purposes of the Act. The Secretary would also issue compliance guidelines and could promulgate regulations.
That sequence places designation before disclosure. A developer is not simply handed a universal government form and told to decide whether every AI event belongs on it. First, a regulator would define a perimeter around a subset of models and developers. Only then would the reporting duty attach to activity related to a covered model. The proposal also allows the Secretary to coordinate with other agencies to identify reportable activity and to receive, analyze, and act on reports. Reporting is thus part of an institutional response system, not an isolated exchange between a company and a filing portal.
The proposal gives the perimeter practical importance by defining a covered developer broadly enough to include more than the organization that originally trained a model. A covered developer would include a person or entity that develops or trains a covered model, or substantially modifies one—including through fine-tuning or another modification of model weights—in a way the Secretary determines causes the model to meet an established threshold. The details are not fixed in the bill. There are no numerical capability cutoffs or complete evaluation protocols in the text. Those choices are delegated to later rulemaking, where they will determine how large the perimeter actually becomes.
This is the first reason the form is downstream of the threshold. If the coverage rule is too narrow, important systems never enter the reporting regime. If it is too vague, developers cannot know when the duty applies and regulators cannot apply it consistently. If it is so broad that every uncertain event becomes a potential filing, the system can be overwhelmed and meaningful signals can be buried. The Secretary’s proposed obligation to minimize ambiguity, duplication, and undue reporting burden is therefore not housekeeping. It is part of making the threshold usable.
Reporting begins with a decision before a report exists
A reporting form normally appears to begin with a blank field: describe what happened. In a threshold system, several earlier questions govern that field.
First, is the actor and model covered? Second, is the observation one of the activities that the law treats as reportable? Third, can the developer observe enough to know or reasonably believe that the activity occurred? Fourth, does the information require ordinary, expedited, supplemental, or some other response? The answers determine whether a form is completed, when it is completed, and what the receiving institution can reasonably do with it.
H.R. 9477 makes that sequence visible. The proposed reporting duty would arise no later than seven days after a covered developer knows, or reasonably believes, that reportable activity related to a covered model has occurred. The bill would also require expedited reporting for activity presenting an imminent or ongoing risk of serious harm. This is not a rule that waits for a fully investigated event before permitting government attention. It uses a knowledge standard and then provides a mechanism for adding material information as it becomes available.
The substance of the boundary is equally important. The bill includes behavior suggesting that a model is trying to evade human oversight, deceive evaluators or operators, circumvent safeguards, resist shutdown or modification, obtain unauthorized access, or otherwise undermine reliable human control. It includes unauthorized access to or attempted theft of model weights and evidence that weights have been exfiltrated or materially compromised. It covers capabilities that could materially enable offensive cyber operations or the development of chemical, biological, radiological, nuclear, or explosive weapons. It also includes some unprompted capabilities that could accelerate the development of more capable AI systems.
Several of these categories are significant because they do not depend entirely on a completed downstream catastrophe. A developer may see a model attempting to defeat controls or evidence that weights are being exfiltrated without knowing what an outside actor will do next. The proposal also covers a circumstance in which serious harm was reasonably likely but was prevented only by unrelated conduct, lack of user capability or intent, or other fortuity. In other words, a near miss can matter when the safeguard did not reliably prevent the outcome.
At the same time, the text does not turn every alarming evaluation into a report. Behavior elicited solely through an evaluation designed to produce it is excluded when the model is not in production and the behavior is not indicative of analogous behavior in deployment. That qualification illustrates why a list of categories is not enough. The real decision depends on context: what was the test, where did it occur, what did it show, and why should it be treated as evidence about deployment?
The proposed form would then carry the information needed to make the signal useful: a description of the activity, when it was discovered, known or suspected threat actors and attack vectors, vulnerabilities or safeguard failures, causal context, and known or reasonably suspected implications for national security or public safety. The Secretary would require supplemental reports as material facts and mitigation steps became available. The report is therefore better understood as a time-stamped evidence packet that can change, not as a final narrative that must be perfect on the first day.
That design creates a practical tension. Early reporting is valuable because the intervention window may be short. Early facts are also incomplete, and the developer may have incentives to delay, minimize, or over-classify uncertainty. H.R. 9477 addresses part of that tension through proposed protections for sensitive information, disclosure exemptions, preservation of applicable privilege, restrictions on certain uses of reports, and an explicit good-faith approach to incomplete facts. It also preserves investigative and compliance powers, including inspection, subpoenas, corrective action, and civil penalties. The incentives are part of the threshold's operation: a duty that cannot be used safely will produce distorted information even if its categories are well written.
The three layers a threshold must survive
The research paper accompanying this subject offers a useful way to understand why a complete-looking law can still miss important events. It describes a three-layer dependency chain. The first layer is data infrastructure: what can actually be detected, by whom, and with what visibility. The second is definitional infrastructure: what counts as an incident, how harm is categorized and scored, and what unit of analysis applies. The third is trigger logic: the thresholds and decision rules that determine whether a case is escalated, alerted, or discarded.
The order matters. If a harm category has not been defined, it cannot be scored. If it cannot be scored, it may not cross a severity threshold. If the threshold requires information no actor holds, it cannot be applied consistently. A regulator can write a precise sentence about serious risk and still lack a measurement system capable of telling anyone when the sentence has been satisfied.
Consider a pre-harm signal. A developer may observe assistance related to a CBRN capability or model-weight exfiltration while lacking visibility into the downstream actor, the target, or the eventual damage. A framework that requires confirmed harm makes the developer wait for evidence that the developer may never be able to see. The paper proposes that pre-harm escalation is most defensible when the intervention window is narrow, severe and irreversible harm is likely without action, and no single actor can see both the risk pathway and the resulting harm. H.R. 9477 reflects part of this logic in its treatment of dangerous capabilities, loss of control, compromise, and fortuity-prevented risk, but leaves important operational judgments to future rules.
Now change the unit of analysis. The paper reports stress tests involving cumulative non-consensual deepfakes and psychological harm from human–AI interaction. It reports approximately 6,700 non-consensual images per hour at peak in one case and approximately 500,000 weekly users exhibiting specified risk factors in a developer disclosure. The significance of those figures is not that they settle the underlying harms; the paper says they are evidence used in its own stress testing, and the quantities were not independently reverified here. The significance is structural. A single image or interaction may be below a severe threshold while the pattern across a population is not.
A form that asks only what happened in one incident can therefore erase the incident's scale. The system needs a way to recognize related events, identify a shared technical, capability, or contextual root cause, and assess the composite. This is a definition and data problem before it is a form problem.
Some harms go further. Psychological effects, cumulative manipulation, and gradual erosion of information integrity may have no single start point or resolution. The paper calls these “standing conditions.” Escalation criteria designed for discrete events face a dilemma: if propagation or cross-border relevance is always present, perpetual escalation makes the trigger meaningless; if the system refuses to trigger, an ongoing priority risk becomes invisible. The paper proposes tolerance-based monitoring—shared categories, continuous data rather than isolated snapshots, and escalation for prevalence spikes, sustained increases, or category-specific threshold crossings. That proposal is not a requirement in H.R. 9477, and it depends on baselines that may require sustained collection and cross-developer aggregation.
The opening question for this series is therefore more demanding than “What should the form ask?” It is: what must the system be able to see, name, combine, and act on before a form can carry reliable meaning?
The next question follows directly from this model. Before an incident can be reported, who decides that a model and its developer are inside the perimeter at all? In H.R. 9477, that designation is not a footnote to the form. It is the first substantive threshold.