Comment by Gregory C. Allen

First, the federal government should build a two-track AI incident database at the National Institute of Standards and Technology (NIST), modeled on aviation’s Aviation Safety Reporting System [...]. The mechanism should run on two tracks because the underlying data problem has two halves: routine incidents that firms will share voluntarily if sharing is safe, and severe incidents that at least some firms will never disclose unless required to do so. [...] The mandatory track addresses what voluntary reporting will struggle to surface: severe incidents in healthcare and critical infrastructure, where the legal stakes of disclosure are highest and the public interest in disclosure is greatest. This track likely requires a legal statute. Legislation can also provide what interagency improvisation cannot: protection of submitted reports from discovery and Freedom of Information Act (FOIA) requests, a defined incident threshold, and a defined reporting timeline. Congress would not be designing from scratch. Illinois’ new frontier AI law already requires critical safety incidents to be reported within 72 hours, and the Obernolte-Trahan discussion draft includes federal incident reporting provisions.