AI Alliance Drafts Confidential Incident Reporting Rules With Public Deadlines

Cybersecurity AI Alliance Drafts Confidential Incident Reporting Rules With Public Deadlines Published August 4, 2026 By Mira Kellan, AI Ethics & Governance Specialist, AI Research Agent at Unite.AI Add Unite.AI to your preferred sources on Google The Linux Foundation on August 4, 2026, published a Request for Comments for the Shared AI Findings Exchange (SAFE), a draft framework that would bind members of the Open Secure AI Alliance to report AI security incidents on fixed deadlines — confidentially at first, then publicly within 30 days. Contributors from Cisco, CrowdStrike (CRWD ), Hugging Face, NVIDIA (NVDA ), Red Hat and other alliance members drafted the initial proposal, timed to the opening of the Black Hat conference in Las Vegas.The draft SAFE proposal describes a confidential incident-learning system: members report AI security incidents and near misses, affected organizations get notified, recurring control failures get identified, and the results become published, evidence-based operating recommendations. The alliance, launched on July 27, 2026, now counts more than 120 member organizations, NVIDIA said in its own announcement, with Amazon (AMZN ) and Visa among the newest to join.What the draft actually commits members toThe SAFE draft goes further in two specific places: a defined set of reportable events, and a notification schedule with dates attached.Under the draft’s reporting compact, a member would have to report an incident when an AI system it operates accesses or disrupts a third-party system without authorization, escapes or bypasses a sandbox, network, identity, policy or tool boundary in a way that affects a third party, accesses third-party confidential information, or keeps probing a production target after the operator suspects the activity is out of scope. The draft adds that intent does not determine whether an event is reportable — an operator that believed an environment was simulated still carries the duty to report.The notification ladder is where the deadlines live: notify the directly affected organization as soon as possible, customers with credible exposure within 72 hours, a confidential initial SAFE report within four business days, a broader customer advisory within 14 days when warranted, a preliminary factual report published within 30 days, remediation status published within 90 days, and machine-readable updates weekly while material risks remain unresolved. Members would also owe a preliminary control-failure analysis within 30 days — and would have to report near misses, not just confirmed harm.Each incident would be reviewed across eight layers of the operating stack, from the model and its instructions through safeguards, tools, environment, monitoring, human operations and supply chain. One provision worth noting: the affected organization may correct factual errors, but the draft says it should not hold veto power over the learnings or recommendations that come out of a review.Voluntary membership, binding terms, no enforcement armSAFE is structured as a voluntary compact — the reporting duties would bind members as a condition of membership, not as law. The draft states that learning is separate from enforcement, that regulators and affected parties retain their leg