When an AI system goes wrong, several reporting clocks may start at once. Some are new and AI-specific. Most are not.
AI-specific duties
California. Since January 2026, large frontier model developers must report critical safety incidents to the state’s Office of Emergency Services within 15 days of discovery, or within 24 hours to the authorities if there is an imminent risk of death or serious injury.
European Union. Providers of general-purpose models with systemic risk must report serious incidents to the AI Office. From December 2027, providers of high-risk systems must report serious incidents to market surveillance authorities, with short deadlines that shrink for the most severe cases.
United Kingdom. There is no AI-specific reporting duty. In October 2026 the House of Lords rejected an amendment that would have required AI developers to report incidents under the Cyber Security and Resilience Bill.
The duties that already apply
If the incident involves personal data, the GDPR and UK GDPR 72-hour breach notification applies. If it affects network security, NIS2 in the EU and the UK network security rules apply. If it is an exploited vulnerability in a connected product, the EU Cyber Resilience Act’s 24-hour early warning has applied since September 2026.
An AI incident is rarely only an AI incident. It is usually also a data, security or consumer incident.
What to do
Add AI scenarios to your incident response plan: a model that leaks data, gives harmful advice, or makes a run of wrong decisions. For each, map which reporting duties could apply and who decides within the first 24 hours.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.