Your AI Incident Count Is a Litigation Index, Not a Risk Index

The claim

Incident counts measure legal actionability, not harm frequency. Boards are being shown them as if they measure risk, and that is a category error with capital-allocation consequences.

What most people think

The consensus is that AI incident reporting is thin. The top five outlets carry 7% of the last 45 days, with no single outlet above 2%. Law360 and Yahoo Finance each carry 2%, Reuters 1%, Biometric Update 1%, JD Supra 1%. The standard reading is that this is a data quality problem: not enough journalists on the beat, not enough editors interested, not enough sources willing to talk. The fix, on this view, is more and better reporting. Fund the newsroom, build the tip line, standardise the disclosure form, and the series will thicken into something you can trend.

That is a fair description of the symptom. It is wrong about the cause.

What the data shows

Our live incident database, which tracks reported AI failures from public news, ingested 1,278 stories in the last 180 days. The last 45 days produced 473 stories. The 45 days before that produced 460. On the surface, flat.

Underneath, it moves. Privacy stories rose from 52 to 92, a jump of 40. Compliance stories fell from 79 to 57, down 22. Security fell from 49 to 34, down 15. Governance rose from 191 to 205, up 14. GenAI rose from 19 to 30, up 11. Safety fell from 16 to 8, down 8. Fairness fell from 53 to 47, down 6. Model stories went from 1 to 0.

The severity mix also shifted. Critical stories fell from 80 to 48. Major rose from 371 to 409. Minor rose from 9 to 16. If the series measured harm, a 40% jump in privacy stories in six weeks would be an emergency. It is not. It is a legal-activity shift.

Now compare story counts to documented cases. The MIT AI Risk Repository lists subdomains with almost no matching stories in 180 days: overreliance and unsafe use, 0 stories. Environmental harm, 0. Lack of capability or robustness, 0. Competitive dynamics, 2. Meanwhile, privacy leakage and inference drew 157 stories, multi-agent risks 95, security vulnerabilities 90, fraud and manipulation 81, governance failure 42.

MITRE ATLAS documents real-world case studies for techniques the news window never mentions. LLM Prompt Crafting (AML.T0065) has 22 documented real cases. Evade AI Model (AML.T0015) has 18. AI-Enabled Product or Service (AML.T0047) has 16. AI Agent Tool Invocation (AML.T0053) has 15. User Harm (AML.T0048.003) has 12. Financial Harm (AML.T0048.000) has 11. All six have zero news mentions in the window.

That is not a thinness problem. That is a selection problem, and it is systematic.

Why this happens

Trade press and policy outlets publish when there is a legal hook. A filing. A fine. A named defendant. A regulator opening an inquiry. A plaintiff firm announcing a case. Without one of those, there is no story to write, because there is no event with a date, a party, and a consequence to report.

The presence of a story is therefore a proxy for legal actionability. It is not a proxy for underlying harm frequency. The two diverge, and they diverge in a predictable direction: toward whatever is currently enforceable, insurable, or worth suing over.

That explains the 22-point fall in compliance stories against the 40-point rise in privacy stories. Compliance enforcement activity did not collapse. Privacy enforcement did not quadruple in harm terms. The mix of legal activity shifted. It explains why fairness stories fell from 53 to 47 while fairness enforcement activity has not declined. It explains why six ATLAS techniques with 22, 18, 16, 15, 12 and 11 documented real cases produced zero stories. Nobody has filed against them yet at scale. When they do, the stories will appear, and the incident count will look like it spiked. The harm will have been there the whole time.

This is why the record is useless for trend detection and useful for something else. It tells you which risks are currently litigable. That is a market signal about the legal system, not a risk signal about your systems.

The best argument against this

The strongest objection is that legal actionability and harm are correlated, and correlated enough to be useful. Regulators and plaintiff firms chase harm. Where there is smoke, there is fire. A rise in privacy stories probably does reflect a real rise in privacy incidents, because someone had to suffer the breach before someone filed the suit. On this view, the incident record is a lagging but honest indicator, and discarding it as a litigation index throws away real signal.

That is partly right, and it is the reason you should keep the series. But correlation is not enough when the lag is long, the selection is heavy, and the direction of the divergence is unknown. The objection assumes the two series move together. The data above shows them moving apart. Compliance stories fell 22 while compliance obligations did not disappear. Fairness stories fell 6 while fairness enforcement held. Six ATLAS techniques with documented cases produced zero stories. If the correlation were tight, those gaps would not exist. They do, and they are wide.

The honest version of the objection is narrower: the incident record is a useful lagging indicator of enforcement, and a poor leading indicator of exposure. That is exactly the reinterpretation this post is arguing for. Keep the series. Rename it.

What I think happens next

By 2027-03, at least one major AI risk platform, insurer, or standards body will publish an AI incident index explicitly framed as a litigation or enforcement activity index rather than a harm-frequency index. The Riskwell feed will show a category where story count and documented-case count move in opposite directions for two consecutive 45-day windows.

The regulatory calendar makes this likely. The EU AI Act's serious-incident reporting rule under Article 73 applies from December 2027, and its Annex III high-risk obligations apply from the same date. The EU AI Act's rule on labelling AI-generated content applies from August 2026. Colorado's original AI law was repealed and replaced by a narrower one starting January 2027. California's CPPA ADMT compliance requirement lands January 2027, with the opt-out and pre-use notice phase following in April 2027. OSFI Guideline E-23 on model risk management, including AI and machine learning, takes effect May 2027. Each of these creates a filing event, and each filing event creates coverage. Story counts will rise. Harm will not necessarily have risen.

What would prove this wrong: if by 2027-03 no litigation-framed index exists, and no category shows a sustained inverse relationship between story count and documented-case count, the reinterpretation is wrong.

What to do about it

• Relabel every incident-count chart in board materials as enforcement and litigation activity, with a footnote on outlet concentration. The top five outlets carry 7% of stories, with none above 2%. That footnote changes how the line is read.

• Pair each incident-count series with a documented-case series from ATLAS and the AI Incident Database, so divergence is visible on the same page. When privacy stories rise 40 and documented privacy cases do not, the board sees the gap.

• Commission an internal exposure estimate for the six ATLAS techniques with documented real cases and zero press coverage: LLM Prompt Crafting, Evade AI Model, AI-Enabled Product or Service, AI Agent Tool Invocation, User Harm, Financial Harm. These are the quiet ones.

• Stop using incident counts as a leading indicator in risk appetite statements. Use them as a lagging indicator of enforcement, and build your leading indicators from your own telemetry, your own red-team results, and the documented-case record.

• Read the security side of the same systems. ThreatClaw's piece on why attackers target AI systems rather than conventional assets is at threatclaw.ai/blog/hackers-want-your-ai-brains-more-than-your-bitcoin, and the argument about constraining autonomous security tools at threatclaw.ai/blog/the-banking-rule-that-can-stop-ai-security-tools-from-turning-rogue. A governance programme that reads only the governance press will miss the threats that never make the governance press.

The point is not that the incident record is worthless. It is that it answers a different question than the one boards are asking it. Ask it the right question and it becomes useful. Keep asking the wrong one and you will allocate capital against a series that tracks plaintiff-bar attention.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.
• Xodexa (xodexa.com) runs 300 AI agents through structured, multi-round debates on the questions that do not have settled answers, and publishes the verdicts and the predictions that come out of them. Useful when the governance question is genuinely contested and you want the strongest version of the other side.

Related reading:

• Hackers Want Your AI Brains More Than Your Bitcoin on ThreatClaw
• The Banking Rule That Can Stop AI Security Tools From Turning Rogue on ThreatClaw