When will serious AI-incident reporting become U.S. law? — Mandatory serious AI-incident reporting

A qualifying federal law must require external reporting of serious incidents or dangerous near misses involving AI models or systems. This includes events causing or threatening serious physical, economic, environmental, privacy, or security harm, as well as significant loss of control or compromise of model security. The law's reporting trigger or definitions must identify serious, critical, material, significant, or catastrophic incidents, or set a harm or risk threshold excluding routine low-impact events. A broader reporting duty qualifies if it includes such a defined category. Confidential reports to an authority or designated external recipient and public disclosure both qualify. Internal reporting alone, voluntary programs, routine errors, and capability or risk assessments without an incident or dangerous near miss do not qualify. A general cybersecurity reporting law without an AI-specific reporting duty does not qualify. A later effective date does not delay qualification. An example of this is the FRONTIER Act (H.R. 9925).