Incident reporting deadline and recipient

NIKOLAI editorial proposal (unsourced): Incident reporting deadline and recipient is an if-then rule -- if an Incident meets a source's reportability trigger, then a report is owed to a named recipient (a regulator, agency, or the AI Office) within a specified clock, sometimes with a shorter emergency clock for imminent physical harm. NIKOLAI proposes recording the trigger condition, the clock (in days or hours from the triggering event), the recipient, and any follow-up/final-report obligations as four sub-properties of this rule, since no two sources currently share identical timing.

This is CASRAI's own proposed definition, not a definition any named organisation has agreed to. See what NIKOLAI is and is not.

Source of record

Where this definition comes from

Anthropic Advanced AI Framework, p.7
“"Critical Safety Incidents. Require Covered Developers to report Critical Safety Incidents to the designated Agency within 15 days of the Covered Developer discovering the Critical Safety Incident or facts that would lead the Covered Developer to have a reasonable belief that a Critical Safety Incident has occurred. Reports should be shared with relevant federal government agencies and national laboratories. Information shared should be exempt from public records disclosure laws, consistent with existing state law." (fetched and extracted directly with pypdf, 16 Sep 2026, fourth pass; p.7). Note the text says "the designated Agency" (lower-case "designated"), not a capitalised defined term.”
https://www-cdn.anthropic.com/files/4zrzovbb/website/0a58d567024a8b448ff15158ebc3625328dfcc1f.pdf
EU GPAI Code of Practice, Safety and Security Chapter, Commitment 9 / Measure 9.3
“Measure 9.3 gives four numbered, harm-typed clocks running from when the Signatory "become[s] aware of the involvement of their model in the incident": critical-infrastructure disruption "not later than two days"; serious cybersecurity breach (incl. weight exfiltration) "not later than five days"; death "not later than 10 days"; serious harm to health, fundamental rights, property or environment "not later than 15 days". Intermediate reports follow "at least every four weeks"; a final report is due "not later than 60 days after the serious incident has been resolved". Recipient: "the AI Office and, as applicable, national competent authorities" (Commitment 9).”
https://ec.europa.eu/newsroom/dae/redirection/document/118119
California SB 53, 22757.13(c)
“"within 15 days of discovering the critical safety incident" to OES; "within 24 hours to an authority, including any law enforcement agency or public safety agency with jurisdiction" where there is "an imminent risk of death or serious physical injury" (22757.13(c)).”
https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53

Crosswalk

How named organisations use this concept

Every row below is a shadow mapping. A shadow row is CASRAI's own reading of a published document. No lab, evaluator or regulator named on a shadow row has declared, endorsed, or been consulted on it. That changes only when an organisation files its own Mapping Declaration.

Organisation	Their term, as published	Match & verification	Source
AnthropicShadow mapping Anthropic Advanced AI Framework	“"Critical Safety Incidents. Require Covered Developers to report Critical Safety Incidents to the designated Agency within 15 days of the Covered Developer discovering the Critical Safety Incident or facts that would lead the Covered Developer to have a reasonable belief that a Critical Safety Incident has occurred. Reports should be shared with relevant federal government agencies and national laboratories. Information shared should be exempt from public records disclosure laws, consistent with existing state law." (verbatim, p.7). Note the text says "the designated Agency" (lower-case "designated"), not a capitalised defined term "Designated Agency" as earlier drafts of this row implied.” This is a legislative proposal, not a binding rule Anthropic has committed itself to as a developer; "the designated Agency" is recipient-TBD language, not a named agency.	closeCL confidence: high	Anthropic Advanced AI Framework
OpenAIShadow mapping OpenAI Frontier Governance Framework; OpenAI -- Hugging Face Incident and the Road Ahead	“"If an incident is determined to be reportable, we will gather relevant information ... for reporting to appropriate authorities within the required deadlines" (FGF §2.6). Internal 30-minute pause rule referenced alongside it.” "the required deadlines" is not itself quantified in the quoted text -- it references external law rather than stating OpenAI's own clock.	closeCL confidence: medium	OpenAI Frontier Governance Framework
xAIShadow mapping xAI Frontier AI Framework, 30 June 2026	“"When reportable under applicable laws and regulations, xAI will provide the relevant authorities with a copy of the incident report within the required deadlines" (s.3).” The FAIF26 PDF's own metadata /Title reads "Privileged/Confidential DRAFT working FRAMEWORK DOC"; no xAI statement disambiguating draft vs. final status was found (open-VERIFY register item 4). Also note: like the OpenAI row, this defers to external law rather than stating xAI's own clock.	closeCL confidence: medium	xAI Frontier AI Framework, 30 June 2026
MetaShadow mapping Meta Advanced AI Scaling Framework v2	“"reporting critical incidents as appropriate" (§2.3.2).”	noneDU confidence: medium	Meta Advanced AI Scaling Framework v2
EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter	“Measure 9.3 gives four numbered, harm-typed clocks running from when the Signatory "become[s] aware of the involvement of their model in the incident": critical-infrastructure disruption "not later than two days"; serious cybersecurity breach (incl. weight exfiltration) "not later than five days"; death "not later than 10 days"; serious harm to health, fundamental rights, property or environment "not later than 15 days". Intermediate reports follow "at least every four weeks"; a final report is due "not later than 60 days after the serious incident has been resolved". Recipient: "the AI Office and, as applicable, national competent authorities" (Commitment 9).”	exactEQ confidence: high	EU GPAI Code of Practice, Safety and Security Chapter
California SB 53Shadow mapping California SB 53	“"within 15 days of discovering the critical safety incident" to OES; "within 24 hours to an authority, including any law enforcement agency or public safety agency with jurisdiction" where there is "an imminent risk of death or serious physical injury" (22757.13(c)).”	exactEQ confidence: high	California SB 53
Frontier Model ForumShadow mapping Frontier Model Forum -- Information Sharing Issue Brief	“"Incident reporting: a formal notification submitted to a designated government body or authority that a qualifying AI safety or security incident has occurred." Warns against "reporting timelines that assume root-cause analysis is already done" (para.).”	closeCL confidence: medium	Frontier Model Forum -- Information Sharing Issue Brief
New York (RAISE Act, S8828)Shadow mapping NY RAISE Act	“New York S8828: reports to a DFS office "within 72 hours" (para.).”	exactEQ confidence: medium	NY RAISE Act (S8828)

What do these codes mean?

exact: The source term is equivalent to this element
close: The source term is close but not equivalent to this element
broad: The source term is broader than this element
narrow: The source term is narrower than this element
none: No mapping claim — used for false-friend and declared-but-undefined rows
EQ: Equivalent
CL: Close
BR: Source is broader than the element
NR: Source is narrower than the element
FF: False friend — same or similar label, different meaning
DU: Declared but undefined by the source
UV: Unverified