Demanding mandatory incident reporting
It is already law in the European Union: article 73 requires reporting serious incidents within 15 days at most, two in cases of widespread infringement and ten when a death is involved. Whether it exists and gets enforced depends on sustained public pressure.
- Level
- Civic
- Cost
- Low cost
- Effort
- Hours
- Evidence
- Observed
What it does not solve
It prevents no catastrophe on its own: it produces information after the fact, and only about providers inside a jurisdiction that enforces. It does not reach offensive state actors or anyone deploying outside the legal framework, which is precisely the route with observed evidence.
It works if what is missing is early warning, which is the bottleneck in almost every scenario. And it is not an aspiration: it is already law in force in the European Union. Article 73 requires serious incidents to be reported to the market surveillance authority immediately after establishing the causal link or its reasonable likelihood and, in any case, within no more than 15 days; no more than two in the case of a widespread infringement; and no more than ten where a death is involved. The authority must act within seven days [23]EU AI Act — Article 73: Reporting of Serious IncidentsView source ↗. For general-purpose models with systemic risk, Article 55 adds adversarial testing, assessment and mitigation of systemic risks, model cybersecurity and reporting without undue delay [22]EU AI Act — Article 55: Obligations for providers of general-purpose AI models with systemic riskView source ↗.
It does not work if the actor is outside the jurisdiction, or outright outside the law. A state using a model for cyber-espionage does not fill in forms.
Evidence. High as a real lever, because the text exists and has deadlines. What is not measured is its effect, and that depends entirely on enforcement.
Cost. Low for one person: voting, taking part, applying pressure, responding to public consultations. It is where individual effort goes furthest.
What it does NOT solve. Nothing on its own. It produces information after the fact, which is exactly what is missing today, but arriving late and well informed is still arriving late. The proposal of a 72-hour deadline for critical incidents is aimed at that gap [408]Recommendations for the U.S. AI Action PlanView source ↗.
Works if…
- Catastrophe through misuse · Works
It is the lever with the best ratio of personal effort to systemic effect, because it produces early warning about capabilities that today only their developers can see.
- AI as normal technology · Works
- Rapid loss of control · Partial
A 15-day deadline is slow for a scenario whose core argument is that the window closes before anyone notices.
- Power grab by a small group · Partial
- Gradual disempowerment · Partial
See in the protection matrix →Report a mistake in this entry →
Sources
- [23] EU AI Act — Article 73: Reporting of Serious Incidents · Unión Europea 2026
- [22] EU AI Act — Article 55: Obligations for providers of general-purpose AI models with systemic risk · Unión Europea 2026
- [408] Recommendations for the U.S. AI Action Plan · Future of Life Institute 2025