Laws compared
A cell records what a text requires of the parties it defines. It does not show that any developer falls within them, or complied.
What does each binding government instrument that addresses developers of frontier or general-purpose AI models say on the same questions? Each column is one instrument; each row is one question, worded so that it fits every instrument. The questions are Selekoa’s; an instrument’s own terms appear only in quotation marks. Some instruments address providers of services rather than developers, and the first row quotes the party each one defines.
Question Q07Incident reporting
Must the covered party report incidents to a public authority, and within what time?
Criterion: A duty to report incidents, defined however the instrument defines them, to a named public authority. The deadline is quoted where stated. Partly if a reporting duty has no stated deadline, or runs to someone other than a public authority.
What the statuses mean
- Stated
- A passage of the instrument meets the question’s criterion as worded, however conditional or narrow its scope. The condition or scope is in the note.
- Stated, partly
- A passage has what the criterion asks for, but in a weaker form than the criterion’s own words: for example, a power (“may”) where the criterion asks for a duty (“shall”), or a duty without the deadline the question asks about.
- Not found in the recorded search
- No passage meeting the criterion was found. The cell lists the sections read, the search terms and every passage set aside, with the reason. It does not show that the instrument lacks such a provision elsewhere, or that no other law imposes one.
- Does not apply
- The question does not arise for this instrument, for the reason given (for example, there is no framework document whose publication could be asked about).
Four rules decide “partly” in borderline cases:
- An order to an agency to impose a duty counts as partly.
- Protection only by reference to another law counts as partly.
- “Without undue delay” counts as a stated deadline.
- Required security measures for model weights count as risk-management measures under Q03.
Every stated or partly cell quotes the instrument’s own text with its article, section or page; Chinese passages carry Selekoa’s working translation. Three cells give a paraphrase with its locator instead, and say so. A not-found cell lists the sections read, the terms searched and every passage set aside, with the reason.
Paraphrased with its locator, not quoted: quoting it would pass the source’s quotation limit, or the source’s length is not known.
Limits of this comparison
- A cell records what the text requires of the parties it defines. It does not show that any named developer falls within them, or that anyone complied.
- A not-found cell is bounded by its search: the sections read and the terms searched. Another provision, or another law, may still impose the duty.
- The Code of Practice is a compliance route, not a law. Executive Order 14110 is revoked, and the BIS rule’s rescission was announced; each column shows its standing.
- The table compares and does not rank. Statuses are not scores and are not to be summed.
- Biological and chemical risk provisions are recorded at policy level only.
- Dates keep their kind: adoption, signature, approval, publication, entry into force and application are different events. A computed date is marked as computed.
How we searched
The instruments started from those on the frameworks-and-law page. A column was kept where the instrument is binding, or is the AI Act’s stated means of compliance (the Code), and places duties on developers or providers of frontier or general-purpose AI models. Fifty other instruments on that page were set aside, each with its reason, in the research pack: proposed or vetoed texts, guidance and reports, voluntary commitments, binding texts that place no duty on developers, and one standard whose text was not retrieved (GB 45438-2025).
United Kingdom: within the searches made, no UK law or other binding instrument placing duties on developers of such models was located. This is not a finding that none exists. The 2024 King’s Speech announced an intent to legislate; the 2026 briefing notes contain none of the searched terms; the memoranda with developers state that they are not legally binding; and title searches of legislation.gov.uk for 2023 to 2026 found one instrument, which places a duty on the Information Commissioner.
Other US federal texts: as read, none places a binding duty on developers. Executive Order 14409 of 2 June 2026 provides for a voluntary access framework and says that its section 3 authorises no licensing requirement.
Not yet read: the Republic of Korea’s AI Basic Act, Japan’s AI Promotion Act (2025), China’s provisions on deep synthesis (2022) and on algorithm recommendation (2021), and Colorado SB 24-205 (2024). They are not in the dataset; a later pack starts with Korea.
Illinois: the act’s official website refused the preparer’s requests, and the Internet Archive reset the connections. The cross-family checker’s session saved the enacted text from an Internet Archive capture of the official PDF (2026-09-08), and the cells were drafted from that saved text. The two model families read the act independently and agreed on the status of 13 of 15 cells. The approval date rests on the checker’s copy of the official bill status record, which the preparer could not open; it is given as a paraphrase, labelled as that copy.
Texts were read in official copies: the EU texts through the Publications Office’s repository, because EUR-Lex returned empty responses; California SB 53 from the Legislative Counsel’s database file, because its website refused requests; New York’s chapters in the Senate print and the Assembly’s bill records, not the session laws; the Chinese measures in the gov.cn policy library. Six web pages served changed bytes between retrievals; every quotation still matched.
Roles: one model family (Claude) drafted the cells, audited 50 of them in a fresh context and adjudicated. A model from another family (GPT, through Codex) checked 122 items, answering 85 of them blind before seeing the drafted answers. Where it disagreed, its status was applied. One cell it disputed (Executive Order 14110, Q06) was settled as not found after its second pass. For Illinois the roles were reversed: the checker read the act first, blind, and the drafter then wrote all fifteen cells without seeing its answers. The maintainer decided the remaining questions, including the four rules for “partly” and Illinois Q05 (partly, as for California’s identical wording). No person has checked the cells against the texts.
European Union
EU AI Act
Stated
“report, without undue delay, to the AI Office and, as appropriate, to national competent authorities, relevant information about serious incidents”
Article 55(1), point (c)
Note: Applies to providers of models with systemic risk. The timing is 'without undue delay'; no number of days is set in the Regulation. 'Serious incident' is defined in Article 3(49) by reference to an AI system (not quoted).
Inspect sources and checks: EU AI Act, Q07 Incident reportingEU Code of Practice, Safety and Security
Stated
“an initial report that is submitted to the AI Office”
Measure 9.3, first paragraph (PDF p. 26)
“not later than two days after the Signatories become aware of the involvement of their model in the incident”
Measure 9.3, point (1) (PDF p. 26)
Note: Initial-report deadlines run by type of serious incident: two days (critical infrastructure disruption), five days (serious cybersecurity breach), 10 days (death), 15 days (serious harm to health, fundamental-rights infringement, property or environment), 'save in exceptional circumstances'. Reports go to the AI Office and, as applicable, national competent authorities; intermediate reports at least every four weeks and a final report within 60 days of resolution.
Inspect sources and checks: EU Code of Practice, Safety and Security, Q07 Incident reporting
United States: states
California SB 53
Stated
“report any critical safety incident pertaining to one or more of its frontier models to the Office of Emergency Services within 15 days of discovering the critical safety incident.”
SEC. 2, Bus. & Prof. Code § 22757.13(c)(1)
“the frontier developer shall disclose that incident within 24 hours to an authority, including any law enforcement agency or public safety agency with jurisdiction, that is appropriate based on the nature of that incident and as required by law”
SEC. 2, Bus. & Prof. Code § 22757.13(c)(2)
Note: Applies to all frontier developers. Fifteen days from discovery to the Office of Emergency Services; 24 hours to an appropriate authority where the incident poses an imminent risk of death or serious physical injury. “Critical safety incident” is defined in § 22757.11(d). § 22757.13(h)–(i) provides that compliance with a designated federal law, regulation or guidance document is deemed compliance with the section (see Q15).
Inspect sources and checks: California SB 53, Q07 Incident reportingNew York RAISE Act (As amended, Chapter 96 of 2026)
Stated
“shall report any critical safety incident … to the office within seventy-two hours”
Bill text, § 2 (GBL § 1422(3)(a) as re-added), p. 6, lines 9–10
Note: Applies to all frontier developers. Seventy-two hours from a determination that an incident occurred or from learning facts sufficient for a reasonable belief that it occurred, to the office; twenty-four hours to an appropriate authority, including law enforcement or public safety agencies, where the incident poses an imminent risk of death or serious physical injury. Compliance through a designated federal standard is deemed compliance (§ 1422(9), see Q15). Article 44-B as re-added takes effect on 1 January 2027 (Q11).
Inspect sources and checks: New York RAISE Act (As amended, Chapter 96 of 2026), Q07 Incident reportingNew York RAISE Act (As signed, Chapter 699 of 2025)
Stated
“A large developer shall disclose each safety incident affecting the frontier model to the attorney general and division of homeland security and emergency services within seventy-two hours”
Proposed GBL § 1421(4), p. 4, lines 43–45
Note: Seventy-two hours from learning of the incident or of facts sufficient for a reasonable belief that one occurred. “Safety incident” is defined in § 1420(13). The disclosure includes the date, the reasons the incident qualifies and a short statement.
Inspect sources and checks: New York RAISE Act (As signed, Chapter 699 of 2025), Q07 Incident reportingIllinois AI Safety Measures Act
Stated
“A frontier developer shall report any critical safety incident pertaining to one or more of its frontier models to … the Agency and the Attorney General within 72 hours of the frontier developer learning facts sufficient to establish a reasonable belief that a critical safety incident has occurred.”
Section 15(c), first sentence, PDF pp. 12–13
“the frontier developer shall disclose that incident within 24 hours to an authority”
Section 15(c), third sentence, PDF p. 13
Note: Applies to all frontier developers. Seventy-two hours to the Agency (the Illinois Emergency Management Agency and Office of Homeland Security, Section 5) and the Attorney General; 24 hours to an appropriate authority, including law enforcement or public safety agencies, where the incident poses an imminent risk of death or serious physical injury. “Critical safety incident” is defined in Section 5 (unauthorised access to model weights resulting in death or bodily injury, harm from a catastrophic risk, loss of control causing death or bodily injury, deceptive subversion of controls). “…” in the quotation stands for the running footer at a PDF page break; no words of the act are omitted.
Inspect sources and checks: Illinois AI Safety Measures Act, Q07 Incident reporting
China
These measures address providers of services, not developers as such.
China, generative AI services (2023)
Stated, partly
“向有关主管部门报告”
Working translation: report to the competent authorities
Article 14 (第十四条), first paragraph
“采取模型优化训练等措施进行整改”
Working translation: take measures such as model optimisation training to rectify
Article 14 (第十四条), first paragraph
Note: Where a provider discovers illegal content (违法内容), it shall promptly take disposal measures (stopping generation, stopping transmission, deletion), rectify, and report to the competent authorities; Article 14(2) adds a reporting duty where users are found using the service for illegal activities. The Measures do not define incidents; the authority is not named beyond 'competent authorities', and no deadline is stated for the report ('及时' qualifies the disposal measures). Search for the rest of the criterion: Articles 9–15 and 19. Terms searched: “报告”, “事件|事故”, “及时”.
Inspect sources and checks: China, generative AI services (2023), Q07 Incident reportingChina, AI content labelling (2025)
Not found in the recorded search
- Read
- Articles 1–14 in full.
- Terms searched
- “报告”, “事件|事故”, “通报”.
- Passages read and set aside
- Article 12 (第十二条): Service providers are to strengthen sharing of labelling information and support the prevention of and crackdown on related crime; no reporting duty or recipient authority is stated. Article 9 (第九条): Retention of logs on recipients of unlabelled content for no less than six months (不少于六个月); a retention duty, not a report to an authority.
Note: No duty to report incidents to a public authority was found.
Open the search record: China, AI content labelling (2025), Q07 Incident reporting
Revoked, or rescission announced
Kept as part of the record, each with its standing shown.
US Executive Order 14110
Not found in the recorded search
- Read
- Whole cached text of the Federal Register printing (88 FR 75191–75226), with close reading of Secs. 3, 4.1, 4.2, 12 and 13 and the signature block.
- Terms searched
- “incident”, “report”.
- Passages read and set aside
- Sec. 4.3(a)(v), 88 FR 75200: Critical-infrastructure agencies' advice on “incident response related to AI usage”; agency task, not a company reporting duty. Sec. 5.2(d)(i), 88 FR 75207: Agency programme on reports of AI-related IP theft; not a company duty. Sec. 8(b)(iv)(A), 88 FR 75215: Common framework for identifying and capturing clinical errors and incidents in health care; agency task. Sec. 4.2(a)(ii), 88 FR 75197: Reporting of computing-cluster acquisition, development or possession; not incidents.
Note: No duty on companies to report incidents to an authority was found.
Open the search record: US Executive Order 14110, Q07 Incident reportingUS BIS AI diffusion rule
Stated
“reporting any theft, loss, or tampering incidents to BIS within 30 days”
Supplement No. 10 to part 748, para. 16, 90 FR 4567 (PDF p. 24)
Note: Applies to VEUs, for chips and other export-controlled items in transit under a shipment security plan; it does not concern models. Para. 11 separately requires VEUs to notify BIS if any requirement has not been met, without a stated deadline.
Inspect sources and checks: US BIS AI diffusion rule, Q07 Incident reporting