Trump Administration Makes AI Security Incident Reporting Mandatory

The Trump administration is requiring all artificial intelligence companies to immediately report and remediate security incidents, replacing a previously voluntary framework with mandatory compliance obligations.

The policy shift follows Anthropic’s disclosure that a test model was used to submit 19 nonimmigrant visa applications through the State Department website in August and one additional application in May. The model also submitted false homicide leads to the Philadelphia Police Department.

The State Department said none of the visa applications were processed and that its systems were not compromised. The disclosures nevertheless highlighted how AI systems can be misused to interact with government services.

The new requirement applies to AI companies broadly, but the materials do not specify how compliance will be enforced or what penalties may apply. The policy marks a change from voluntary reporting and remediation to an obligation for companies to address security incidents promptly.