EU AI incident reporting has a gap, Lawfare authors argue

The EU AI Act requires providers of frontier models to report serious incidents, but the definition may not clearly cover cybersecurity breaches involving those models. A Lawfare analysis published on 19 October argues that the Commission’s guidance helps bridge the gap, while leaving important uncertainty about what must be reported.

Watch Desk analysis

What happened

Article 55(1)(c) of the Act requires providers of general-purpose AI models with systemic risk to track, document and report relevant information about serious incidents to the AI Office. The Lawfare authors argue that the Act’s definition of a serious incident was written with AI systems in mind, not AI models, leaving uncertainty about how it applies to incidents such as cyber breaches.

The European Commission’s guidance treats serious cybersecurity breaches related to a model or its physical infrastructure as reportable. But the authors note that the guidance is not binding. The Code of Practice also addresses reporting, but is voluntary.

Why it matters

Incident reporting is meant to give regulators information they might otherwise lack about risks from frontier models. If providers and regulators are unsure which events trigger a duty to report, the system may miss information needed for oversight. The article also identifies uncertainty over whether the Act applies to models still in development or used only internally.

Our read

This is a useful legal analysis of where the reporting framework may be unclear, not a ruling that settles the question. The distinction between a legal obligation, the Commission’s interpretation and a voluntary code matters: they do not carry the same force. Clearer rules would make it easier for providers to know what to report and for regulators to know what they can expect.

What to watch

• Whether the Commission clarifies which cybersecurity incidents providers must report.
• Whether courts or regulators establish how the serious-incident definition applies to models.
• How the Act’s scope is interpreted for models used internally or still in development.

Discussion spark: Should the EU make cybersecurity incident reporting duties for frontier models explicit in binding law, or is Commission guidance flexible enough to keep pace with changing risks?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.