US-China AI Incident Notification Proposal Creates Cross-Border Reporting Gap

What happened

Why it matters

• ·Enterprises with AI deployments in both the US and China may eventually face a new tier of incident reporting that sits above domestic frameworks. If a formal mechanism is established, it could require government agencies to be notified of AI incidents that currently stay within enterprise compliance programs.
• ·The proposal exposes a structural gap in most AI incident response programs: there is no defined threshold for when an AI incident becomes a national security notification event. Compliance teams have no existing playbook for that escalation path.
• ·Critical infrastructure operators and dual-use technology firms face the highest near-term exposure. Sector-specific regulators may move faster than a formal bilateral treaty to define national-security-adjacent AI incident reporting requirements.

Governance controls affected

What to do now

• ☐Map your current AI incident classification criteria against a national security threshold and identify which incident types could plausibly trigger government notification obligations.
• ☐Review your AI incident response playbook to determine whether it includes escalation paths to legal, government affairs, or executive leadership for geopolitically significant events.
• ☐Assess which of your AI deployments operate in both US and Chinese jurisdictions and flag them for additional monitoring under any emerging bilateral framework.
• ☐Engage your government affairs team to track the progress of the proposed mechanism and any implementing guidance from the Treasury Department or relevant national security agencies.
• ☐Add a standing agenda item on cross-border AI incident reporting to your next AI governance committee meeting, with a brief on current gaps versus what a formal bilateral framework might require.

What to watch next

Compliance teams should monitor whether the proposed mechanism advances into a formal agreement or executive-level commitment at a Trump-Xi summit. Any implementing guidance from the Treasury Department or the National Security Council would be the first concrete signal of enterprise-level obligations. Sector regulators in financial services, energy, and defense contracting may issue preliminary guidance on national-security-adjacent AI incident reporting before a bilateral treaty is finalized. The White House AI Vulnerability-Sharing Initiative, which similarly left disclosure workflows undefined, is a parallel signal that federal AI incident reporting norms are still being shaped.