The Decline in AI Incidents is a Warning, Not a Win

The steep decline in governance-related AI incident reporting is not a sign of improvement. It is a leading indicator that organizations are shifting incident disclosure from public channels to private legal and compliance workflows ahead of enforceable deadlines.

What most people think

People currently believe that falling incident counts in governance categories mean fewer problems or better AI systems. They look at the reduction in public reports and assume the risk landscape is improving or that companies have fixed the underlying issues.

What the data shows

Our live incident database, which tracks reported AI failures from public news, shows a different reality. In the last 45 days, we tracked 354 stories, compared to 428 in the 45 days before that. The drop is concentrated in specific areas.

Stories about governance dropped by 62, moving from 204 to 142. Stories about compliance rose by 29, moving from 43 to 72. This shift is significant. The total number of incidents fell across all categories, but the governance and compliance buckets moved in opposite directions.

The severity of the incidents did not drop. We still saw 61 critical incidents in the last 45 days, compared to 69 in the previous period. The mix of major and minor incidents remained similar. This suggests the problems are not going away, just the reporting is.

Legal-focused outlets are driving the coverage. JD Supra, Law360, Help Net Security, Tech Policy Press, and Biometric Update make up the top five reporting sources for the last 45 days. This indicates that lawyer-driven coverage, rather than technical reporting, is now the primary lens through which AI failures are seen in the news.

We also see a gap in what the news reports versus what exists in the MIT AI Risk Repository. Categories like Overreliance and unsafe use, Environmental harm, and Lack of capability or robustness have zero stories in our 180-day window. Meanwhile, high-attention categories like Privacy Leaks, Multi-agent risks, and Fraud get most of the coverage.

Why this happens

The mechanism is the approach of enforceable deadlines. Legal teams are increasingly classifying incidents as privileged and routing them to compliance systems. They do not want these issues in the public news feed because it invites regulators and lawsuits.

Upcoming laws are forcing this behavior. The EU AI Act bans certain content types on December 2, 2026, and the marking grace period ends then. The EU AI Act’s high-risk obligations apply in December 2027, and serious-incident reporting rules kick in then too. In the United States, Colorado’s ADMT Act (SB 26-189) becomes effective on January 1, 2027. California’s CPPA ADMT compliance is also required on that date, followed by California ADMT opt-out requirements in April 2027.

Risk teams relying on public incident databases will underestimate their true exposure and misallocate resources. As these laws take effect, the incentive to hide problems in private workflows grows stronger. The news feeds will show fewer incidents, but the internal risk landscape will likely be more volatile than the public data suggests.

The best argument against this

The strongest honest objection is that companies might simply be fixing the problems. Maybe the AI systems are actually more stable now. If the total number of incidents is lower, perhaps the quality of the software has improved, and we are just seeing the results of better engineering.

My answer

If companies were fixing problems, we would see fewer incidents across the board, not just in the public news. Our data shows a drop in every category, including security, privacy, and fairness. The drop is concentrated in the governance and compliance buckets. This suggests the incidents are not disappearing; they are just not being reported to the public anymore.

What I think happens next

By March 2027, public governance incident reports will continue to decline even as total internal AI incidents rise. We will see a growing gap between the public news and what companies actually admit to their shareholders. This gap will widen as the Colorado and California ADMT laws become enforceable. If public governance reports increase while compliance reports also rise, this hypothesis is wrong.

What to do about it

• Establish internal incident reporting metrics that are not correlated with public disclosure.
• Audit whether legal privilege is being over-applied to hide incidents that should trigger risk reviews.
• Create a "safe harbor" for internal reporting so teams can talk about failures without fear of immediate legal retaliation.
• Watch the gap between public news and internal disclosures as a leading indicator of risk concentration.
• Prepare for a surge in private legal and compliance reporting as the 2026 and 2027 deadlines approach.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.

Related reading:

• When Your AI Fails, Who Do You Tell? The New Rules Are Here on ThreatClaw
• How Whistleblower Reports on AI Failures Get Hijacked Before Anyone Reads Them on ThreatClaw