Hanks questions companies on 24-hour AI incident reporting to Cyber Command

Up next, we have Councilmembers Hanks, Dinowitz, and Maloney.

Thank you, Chair.

Thank you, everyone, for being here.

My question is in relation to the disclosure of AI incidents in contracts.

When an AI incident happens, New Yorkers need to have an early warning so they can understand.

And my bill will require city agencies covered under these contracts to notify NYC Cyber Command within 24 hours of learning of a reportable incident.

And it also requires plain language public notice.

So my question is, can your companies realistically meet that deadline and, you know, with the information that the city can act on even before you have finished investigating?

You could start with Ms.

Dwyer.

So thank you for your bill.

We support incident reporting policies and have instituted a robust incident reporting framework internally where any employee can report instances of potential misalignment.

And then those instances are investigated.

Third parties are notified and the public is made aware as well.

Thank you.

Mr.

Cahill?

Thank you, Council Member, and thank you also for your bill.

We have a global incident response program and report incidents as required under the law.

We also support incident reporting.

We think it's very important to have continued public discussions about what information is necessary

or useful for public officials that can be actionable to take further steps to ensure public safety.

We also note that the 24 hours seems to be in conflict with the state requirements for 72-hour reporting on incidents.

But I'm happy to take a look at the different.

Frameworks under proposal and get back to you with a more fulsome response.

Sorry, I appreciate that.

Mr.

Graham, who kind of looks like an AI guy in there.

Can you confirm you're not an AI guy?

Sorry.

I can confirm.

Can you hear me okay now?

Does this work?

No.

Yes, we hear you.

We hear you.

Okay, thank you.

I'm an AI guy, but in a very different way.

I'm an AI researcher.

So first, incident reporting, one of the foundational parts of the safety stack, we think.

We support this.

We support the evaluations and auditing required to find the incidents in the first place, both by externals and internal.

Obviously, it's beyond me to discuss particular, it's outside my expertise to understand sort of deep sort of policy mechanisms here.

But the reality from what I've seen is there are some incidents or issues where what you need to do is investigate and remediate and mitigate with the right folks and the right organizations at the right time.

So I think we would support whatever allows us to achieve that and happy to engage further on the details of how you would.

I appreciate that.