The AI Safety Investigation Act: A Federal AI Incident Investigation and Reporting Authority

Addressed to: Sen. Mark R. Warner (D-VA), Co-Chair, Senate Cybersecurity Caucus

The AI Safety Investigation Act: A Federal AI Incident

Investigation and Reporting Authority

Logan Bradley and Ishan Ajwani Executive Summary This brief proposes the AI Safety Investigation Authority (AISIA), an independent federal agency modeled on the National Transportation Safety Board (NTSB), mandated to investigate significant AI incidents, maintain a centralized incident database, and issue non-binding safety recommendations. Unlike prescriptive regulatory approaches that risk rapid obsolescence, an investigative body generates the empirical foundation for evidence-based AI governance while resolving growing fragmentation across state-level AI safety regimes. Problem Statement The U.S. faces three converging AI governance failures. First, AI incidents are proliferating without systematic documentation. The OECD’s 2026 analysis found that media-reported AI incidents rose from 92 per month in 2022 to 324 per month in 2025 [1]. Yet no federal mechanism exists to collect or learn from these failures, as existing repositories like the Partnership on AI’s Incident Database rely on crowdsourced media reports and lack investigative authority [2]. Second, the regulatory landscape is fragmenting. California’s SB 53 requires frontier developers to report incidents within 15 days [3]. New York’s RAISE Act requires 72-hour reporting to the Department of Financial Services, with penalties up to $3 million [4]. Colorado and Texas have enacted further frameworks [5]. These laws define key terms differently, creating compliance burdens that major developers have called unsustainable [6]. Third, the federal response has been inadequate. The Administration’s March 2026 National AI Legislative Framework proposes preempting state laws in favor of a “minimally burdensome national standard,” but offers no incident investigation mechanism [7]. The bipartisan Secure AI Act (Warner-Tillis, 2024) proposed voluntary databases but was never enacted [8]. No federal entity has authority to investigate an AI incident after it occurs.

Policy Recommendation

The AI Safety Investigation Act Congress should establish AISIA as an independent agency with three core functions:

• Mandatory incident reporting and investigation. Developers and deployers must report safety incidents—where an AI system contributes to death, serious injury, critical infrastructure disruption, or damages exceeding $1 million—within 72 hours. Reporting is triggered by outcomes, not model size, ensuring coverage adapts as capabilities evolve. For mandatory-threshold investigations, AISIA holds subpoena authority over model logs, training records, and decision traces, ensuring investigations are not limited to what developers voluntarily disclose [9]. AISIA also retains discretionary authority to investigate below-threshold incidents revealing systemic risk patterns.
• Centralized incident database. AISIA maintains a public, standardized repository with taxonomies aligned to the OECD’s international framework [10] and Georgetown CSET’s reporting schema [11], subsuming fragmented state channels into a single federal system and providing the evidence base both the Administration and state legislatures have identified as essential for future rulemaking.
• Non-binding safety recommendations. Like the NTSB, AISIA issues recommendations without direct enforcement power. This preserves industry flexibility while creating public accountability: the NTSB has issued over 15,000 recommendations since 1967, roughly 82% of which have been closed in “acceptable” status, driven by reputational incentives and independent investigative weight [12]. Implementation AISIA would be governed by a five-member bipartisan board confirmed by the Senate for staggered five-year terms, independent of the Commerce Department and OSTP. Initial authorization of $75 million annually supports approximately 150 staff in a phased three-year ramp-up, scaling toward the NTSB’s FY2025 level of $145–150 million [13]. AISIA’s preemption is narrowly scoped: the Act satisfies state incident reporting obligations (under SB 53, the RAISE Act, and similar statutes) through federal compliance, but explicitly preserves all state enforcement authority, substantive safety standards, whistleblower protections, and consumer protection powers [14]. Impacts and Trade-offs The primary benefit is information infrastructure. Aviation safety transformed after the NTSB’s creation in 1967; U.S. commercial aviation fatality rates have since declined by over 90% [15]. An equivalent evidence base for AI would enable calibrated rather than reactive regulation. A key challenge is that AI incidents differ from physical accidents: failures are probabilistic, opaque, and contested, and investigations require access to proprietary model internals in ways that physical wreckage analysis does not. AISIA addresses this through a tiered disclosure model: full technical findings—including model architecture, training data, and decision traces—are preserved in restricted annexes accessible only to AISIA and the investigated entity, while public reports focus on systemic factors and recommendations [16]. An evidentiary privilege (paralleling 49 U.S.C. § 1154(b)) prevents AISIA findings from use in civil litigation [17]. To ensure report integrity without chilling disclosure, the Act employs a dual-channel approach. For mandatory reports, developers who knowingly submit false or materially misleading statements face independent civil penalties—modeled on § 1421(5) of New York’s RAISE Act [4]—enforceable by the Attorney General. For voluntary and below-threshold reports, full immunity is preserved to encourage near-miss reporting, mirroring the FAA’s Aviation Safety Reporting System [18]. This incentivizes honest mandatory disclosure while maintaining the high-trust voluntary channel that makes incident databases comprehensive. Resilience to Technological Change This proposal is mechanism-agnostic. Because reporting is triggered by outcomes rather than model architecture or compute thresholds, the framework adapts automatically. The NTSB has maintained relevance across seven decades—from propeller aircraft to autonomous vehicles—because investigation follows failure rather than attempting to anticipate it [9]. An AI investigative body exhibits the same adaptive resilience, providing durable governance regardless of whether frontier risk emerges from large language models, autonomous agents, biological design tools, or capabilities not yet imagined.