AI incident reporting requirements tracker: California, the EU and the House ask compared

Three different clocks now govern, or aim to govern, how fast an AI developer must tell someone about a safety incident. They are not the same clock. They start at different moments, apply to different systems and carry different weight. This tracker lays them side by side and will be updated as rules change.

The comparison

• California, frontier developers. Business and Professions Code section 22757.13 requires frontier developers to report critical safety incidents to the Office of Emergency Services "within 15 days of discovering the critical safety incident." If a developer discovers that an incident "poses an imminent risk of death or serious physical injury," it must disclose it "within 24 hours to an authority, including any law enforcement agency or public safety agency with jurisdiction." A developer that learns more may file an amended report, and the section exempts these reports from the California Public Records Act. The section itself sets no penalty amounts; it relies on definitions elsewhere in the chapter.
• EU, high-risk AI systems (Article 73). Providers must report serious incidents to market surveillance authorities in the member state where the incident occurred. The outer limit is 15 days after the provider becomes aware, 2 days for a widespread infringement, and 10 days where a person has died. Article 73 applies from August 2, 2026. An incomplete initial report is allowed if needed for timeliness.
• EU, general-purpose models with systemic risk (Article 55). Providers must "keep track of, document, and report, without undue delay, to the AI Office" relevant information about serious incidents and possible corrective measures. The article sets no fixed number of days.
• US House Democrats, five labs. Letters dated October 27, 2026 from Frank Pallone Jr., Zoe Lofgren and Jamie Raskin ask Anthropic, Google, Meta, OpenAI and SpaceXSI for notice within 48 hours of discovering a new incident, within 24 hours if critical infrastructure appears involved, and for a full accounting by November 11, 2026. The press release names no statute and sets no penalty.

What each clock actually measures

The headline numbers hide three differences.

The trigger differs. California counts from when the developer discovers the incident. The EU's Article 73 counts from when the provider becomes aware, with shorter clocks for particular categories. The House letters count from discovery of any new or previously unknown misalignment or safety incident.

The subject differs. California regulates frontier developers and critical safety incidents. Article 73 regulates providers of high-risk AI systems, a product-based category. Article 55 concerns the most capable general-purpose models. The House letters name five companies and a broad idea of misalignment and safety incidents.

The force differs. California and the EU are law. The House letters are a request from three ranking members whose party does not control their committees. For the details of that request, see our news report on the House letters.

Same number, different meaning

Several numbers on this page collide. The House ask of 48 hours equals the EU's two day clock for widespread infringements under Article 73. The House's 24 hours for critical infrastructure equals California's 24 hour clock for imminent risk of death or serious physical injury. Yet in each pair the trigger differs, so matching numbers do not mean matching duties.

In hours, the clocks run like this: 24 hours (California imminent risk; House critical infrastructure), 48 hours (House general ask; EU widespread infringement), 240 hours (EU death of a person), 360 hours (California routine report; EU standard serious incident). Article 55's "without undue delay" has no hours at all, which is why a lab operating a general-purpose model with systemic risk cannot read a deadline off the text.

How to use this page

If you work at a lab or a deployer, map your own incident categories to each row before you map your deadlines. If you cover policy, ask which row a new bill would copy. If you are a researcher, note that only California's section creates a state channel for reports, and that it exempts them from the state's public records law, so the public record of incidents will come from lab disclosures and not from the regulator.

What labs publish voluntarily

Voluntary disclosure continues beside the legal clocks. Our tracker of OpenAI's misalignment reports logs the cases that company has published, and our bill tracker for Congress follows the federal proposals. The wider EU timetable is in our EU AI Act deadlines tracker.

What we are watching

• Whether any lab replies substantively by the House's November 11, 2026 date.
• Whether a federal bill adopts a 24 or 48 hour clock, and whether it preempts California.
• Whether the EU sets a number of days for general-purpose model incidents in guidance.

Limits of this tracker

We read California's section 22757.13 and the two EU articles on the pages linked below, and the House press release. We did not read the full California chapter, so definitions of frontier developer and critical safety incident are not reproduced here. We also did not read any lab's internal policy. If you find a deadline we have wrong or missing, the correction loop on this site exists for exactly that.

Change log

• October 30, 2026: page created with California, EU and House entries.

Our take

The fastest clock on this page is the one with no force, and the slowest is the one with it. Until labs share a definition of a critical incident, any comparison of deadlines is partly a comparison of vocabulary. We will update this page whenever a deadline, a definition or a penalty changes.