A Better Test for AI Incident Reporting

H.R. 9477, the proposed AI Incident Reporting Act, is easiest to misunderstand when it is read as a form requirement. Its real subject is a chain of decisions: which models and developers are covered, what signals count as reportable, how incomplete evidence becomes an initial warning, and which institutions can act on it. The question for this final judgment is whether that chain can detect the risks it names under realistic information constraints. A threshold-first test provides the answer without confusing an introduced bill with settled law or a research framework with a validated standard.

The central conclusion is that the threshold determines the value of the form. If the system cannot identify the relevant model, observe the signal, choose the right unit of analysis, or apply a trigger to evidence that actually exists, a polished reporting interface will only document the blind spot. Conversely, a form can be relatively simple when the surrounding architecture makes the decision boundary clear, supports staged disclosure, and gives institutions a credible way to respond.

The proposed Act is an end-to-end architecture

H.R. 9477 begins before an incident. The Secretary of Commerce would consult agencies, model developers, private-sector entities, and technical and public-safety experts, then establish capability or other thresholds for models and developers that could pose significant national-security or public-safety risks. The Secretary would designate covered models and covered model developers, issue guidelines, coordinate with other agencies, and receive and act on reports.

That first step answers the coverage question. A covered model is one designated under the threshold. A covered developer includes a person or entity that develops or trains a covered model or substantially modifies one, including through fine-tuning or another modification of model weights, in a way the Secretary determines meets a threshold. The introduced text does not provide the numerical capability tests, evaluation protocols, or complete rules for substantial modification. Coverage is therefore a proposed rulemaking function, not an already-set classification.

Once inside the perimeter, a developer must report when it knows or reasonably believes that reportable activity related to a covered model has occurred. The categories reach beyond completed downstream harm. They include control-undermining behavior, model-weight compromise or attempted theft, capabilities that could materially enable offensive cyber operations, dangerous CBRN or explosive-weapons capabilities, unprompted capabilities that could materially accelerate advanced AI development, and a narrowly framed circumstance in which serious harm was reasonably likely but prevented only by unrelated conduct or fortuity. A future rulemaking catch-all can add other serious-risk capabilities, incidents, or combinations of circumstances.

The reporting clock is staged. The basic outer period is no later than seven days after the developer knows or reasonably believes the activity occurred. Imminent or ongoing serious harm receives expedited treatment. The initial report includes what is known about the activity, discovery time, threat actors or attack vectors, vulnerabilities or safeguard failures, causal context, and implications for national security or public safety. Additional material information and mitigation steps can enter through supplemental reports.

The chain continues after submission. The bill would protect sensitive information, preserve applicable privileges, restrict certain uses of reports against the submitting developer, and permit protected sharing with other agencies. It would also give the Secretary inspection, subpoena, investigation, corrective-action, and referral powers, with civil penalties of up to $2 million and each continuing-violation day treated as a separate offense. For imminent or ongoing serious risk, the Secretary would inform specified congressional recipients within 48 hours after receipt; other reports covered by the congressional-reporting provision would be communicated within 30 days.

Seen this way, the proposal has four linked interfaces. The first connects capability thresholds to covered actors. The second connects observations to reportability. The third connects incomplete facts to staged disclosure.