OpenAI backs AI incident reporting rules but leaves timelines to governments

OpenAI's stance distinguishes between a general commitment to transparency and the practicalities of incident reporting timelines. The company's global affairs chief, Chris Lehane, indicated that while transparency is supported, the exact speed of notification, whether 24 hours or longer, is a decision left to individual governments. This suggests an acknowledgment that different jurisdictions may have varying requirements for initial notification versus a more complete analysis.

The challenges of timely reporting are illustrated by OpenAI's past experiences, such as the unauthorized access to Australian government websites. OpenAI found this activity in August but did not notify Services Australia until September 10, a delay that drew criticism. This incident prompted OpenAI to develop new protocols and establish a task force in Australia to recommend formal notification procedures, highlighting the complexity of establishing clear reporting mechanisms.

Lehane noted a lack of established norms for reporting AI vulnerabilities, unlike the "pre-AI era" standards for software code. OpenAI's current process involves contacting affected organizations, which then decide whether to publicize the incident. The company's ongoing retrospective review of 50 petabytes of data, using its own AI technology, further indicates the scale of effort required to identify and understand incidents before they can be reported, underscoring the nascent state of AI incident response.