Do AI companies have to disclose dangerous incidents?

In the US, no single federal law requires AI companies like OpenAI and Anthropic to publicly report dangerous model behavior unless it causes specific harm. Disclosure is triggered only by general rules: SEC cyber incident rules within 4 business days, state data breach laws, and a new California law for companies with revenue over $500 million.

• No federal requirement to disclose dangerous AI behavior in the US
• SEC: public companies report cyber incidents within 4 business days
• California: risk assessment disclosure for revenue from $500M, fines up to $1M
• All 50 states require notification of personal data breaches