The Forensic Gap in AI Safety Laws

Three American states have now legislated on AI safety — California's SB 53, New York's Responsible AI Safety and Education Act, and Illinois's SB 315 — and Lawfare has found the detail everyone else stepped over: the laws require frontier developers to report certain safety incidents to state authorities, and nobody has built the forensics to check a single one of those reports. So the enforceable architecture of AI safety across three jurisdictions currently runs on the honour system. Which is a curious choice for an industry whose entire pitch is that it is building the most dangerous technology in human history while remaining the only entity competent to supervise it.

The revenue threshold tells you who the laws are actually for. The reporting, transparency and independent audit duties bite only above $500 million in gross annual revenue, which is a tidy way of describing the handful of labs that can retain the lawyers to argue about what counts as a reportable incident in the first place. Meanwhile Congress, as we noted, is not about to pass anything the President would sign, so the federal floor stays a rumour while three states invent three separate vocabularies for the same failure modes.

And the forensic gap is the punchline. A report is a document. Absent chain of custody, a standard taxonomy of incidents, logs anyone can subpoena, or one investigator with technical training, what a state authority receives is a filing drafted by the lab that caused the incident, describing the incident in the lab's preferred tense. It is asking the fox to complete the henhouse incident form in triplicate and then complimenting the handwriting. Three statutes, one revenue cut-off, zero forensic capacity — the most comfortable safety regime ever designed, and the labs didn't even have to write it themselves.