US–China AI incident-alert proposal: no new rule, but a useful compliance test

Why the proposal still matters

The announcement indicates that the two largest AI powers are exploring structured communication about incidents with national-security consequences. The inference is that international AI governance may increasingly include crisis notification and common incident terminology. Whether this proposal will produce an agreed mechanism, and what it would cover, remain unknown.

For businesses, the practical point is that ‘AI incident’ is not a single legal category. The same event may involve model safety, personal data, cybersecurity, product safety, service continuity, contractual duties or sector regulation. Each regime has its own scope, threshold, recipient and clock.

What is binding in the UK and EU?

In the UK, an AI-related event that compromises personal data must be assessed under the UK GDPR. The Information Commissioner's Office says that, where a risk to people's rights and freedoms is likely, the controller must notify the ICO as soon as possible and, where feasible, within 72 hours. If the risk is high, affected people must also be notified without undue delay. Those duties arise because there has been a qualifying personal-data breach, not merely because AI was involved.

For providers of general-purpose AI models with systemic risk, Article 55 of the EU AI Act includes a duty to track, document and report relevant information about serious incidents and possible corrective measures without undue delay. The Commission states that the general-purpose-model rules have applied since August 2025.

The position for high-risk AI systems must not be collapsed into that rule. Following Regulation (EU) 2026/1744, the AI Omnibus, the Commission states that obligations for Annex III high-risk systems apply from 2 December 2027 and those for high-risk systems embedded in Annex I regulated products from 2 August 2028. Article 73's reporting process should therefore form part of implementation planning, but it is not a universal AI-incident reporting duty in force today.

EU data-protection law, national cybersecurity rules, sector regulation and contracts may independently require notification. The applicable analysis depends on the organisation, system, event and jurisdiction.

Practical steps for founders and technology businesses

1. Use one intake route for AI, privacy, security, safety and service incidents, then assess each applicable legal threshold in parallel.
2. Define who decides when the organisation became aware of an event and record that time; notification clocks should not depend on an informal hand-off between teams.
3. Preserve prompts, outputs, model and software versions, logs, permissions, affected data, decisions and remedial actions without unnecessarily spreading sensitive material.
4. Maintain a jurisdiction-and-regime matrix covering the AI Act, data protection, cybersecurity, sector rules and contractual notices, with named owners and escalation paths.
5. Require suppliers to notify material incidents promptly, preserve evidence, support regulatory assessment and disclose corrective measures and relevant model changes.
6. Prepare a concise incident pack that separates verified facts from hypotheses and can be adapted for regulators, customers and public authorities if a government-to-government mechanism emerges.