When do I need to report an AI agent incident to regulators?

Answer

Reporting obligations vary: EU AI Act requires notifying authorities of serious incidents involving high-risk AI systems. GDPR requires 72-hour breach notification when personal data is compromised. HIPAA requires notification within 60 days for PHI exposure. SEC requires material incident disclosure for public companies. State breach notification laws apply when an agent exposes personal information. Industry regulators may have additional requirements. Best practice: treat any agent action that causes actual harm, data exposure, or discrimination as a reportable event.