In September 2026, the Associated Press reported that US Treasury Secretary Scott Bessent had proposed an AI incident notification mechanism during talks with Chinese Vice Premier He Lifeng.

The proposal would create a channel for sharing information about artificial-intelligence incidents that may affect national security. Details remain limited and China had not publicly accepted the mechanism at the time of reporting, although the discussions were described as candid and constructive. The initiative follows recommendations from US and Chinese security experts for hotlines, human control over critical systems and agreed red lines around nuclear and cyber risks.

A bilateral government mechanism would address extreme events, but the underlying principle applies more widely. Organisations need to identify, classify and escalate AI incidents before they can decide whether clients, regulators, vendors or public authorities should be notified.

AI Incidents Do Not Fit One Existing Category

An AI incident may involve cyber security, data protection, model failure, discrimination, inaccurate advice or unauthorised action. It can also spread across several organisations when companies use the same model, cloud service or data supplier. Traditional incident processes often divide these risks among separate teams, delaying recognition of the broader pattern.

Insurers and benefits providers should therefore maintain a specific AI incident register linked to existing operational-risk systems. The record should capture the model and version, affected workflow, data involved, user impact, actions taken and evidence preserved. Severity should reflect both actual harm and credible potential harm. A fabricated citation in a public article and an automated denial of healthcare are different events, even if both originate in model error.

Notification thresholds need to be defined in advance. Some events require immediate containment and regulatory reporting; others call for vendor escalation, customer communication or internal correction. Contracts should specify how quickly technology providers must report incidents and what technical information they must supply.

Multinational Operations Need a Common Core

A multinational insurer may face different reporting rules across the EU, United States, China and other markets. A common internal taxonomy can provide consistency while local legal teams determine external obligations. The central standard should cover materiality, escalation, evidence retention, executive accountability and lessons learned.

Global benefits networks have a similar exposure. An AI tool may support employee communication, underwriting preparation, claims triage or client advice across several countries. A single error can be reproduced in multiple languages and jurisdictions. Networks should be able to stop a model or workflow centrally, identify affected outputs and notify member insurers rapidly.

Exercises are necessary because a written policy does not prove that the organisation can respond. A tabletop scenario can test who detects the event, who can suspend the service, how affected records are located and who approves communications. The exercise should include the model vendor and key operational partners where possible, then assign owners and deadlines for corrective actions.

The proposed US-China mechanism also raises questions about confidentiality and national security. Governments will need to decide what information can be shared without exposing sensitive systems or proprietary technology. Companies face the same trade-off when disclosing incidents to clients and counterparties. Transparency should be specific enough to support action while protecting personal data and security-sensitive details.

Near misses should also be recorded. A harmful output caught by an employee before publication may reveal the same control weakness as an event that reached a client. Tracking near misses gives management a larger evidence base for improving prompts, permissions, testing and review thresholds.

International agreement may take time, therefore companies should not wait. A tested internal notification process will reduce harm today and make it easier to comply with future cross-border standards. The most useful lesson from the diplomatic proposal is procedural: incidents must have a defined channel, an accountable recipient and a deadline for action.