Christopher David LaRoche says AI safety laws require incident reports but give regulators no way to investigate them
Christopher David LaRocheAssistant professor of international relations at Central European University and Carnegie Endowment Stanton nuclear security fellow, writing a signed analysis piece for Lawfare
In a September 16 Lawfare essay, Christopher David LaRoche argued that the current generation of AI safety laws, California's SB 53, New York's Responsible AI Safety and Education Act and Illinois's SB 315, is an advance but stops at incident reporting. He wrote that none of the three requires a developer to investigate its own incident or assigns investigatory powers to any other actor, leaving developers in control of the evidence and regulators without the means to reconstruct what happened. He identified three obstacles specific to AI: model opacity, evidence that is distributed and mutable, and firms' epistemic advantage over outside investigators. He proposed two statutory requirements that he said need not wait for a formal investigatory regime: a proactive data-retention duty covering model weights, inputs and outputs, logs and operational conditions, and dedicated in-firm units to preserve that evidence and help investigators interpret it. His comparisons with aviation accident investigation and his reading of interpretability limits are his own analysis.
“What happens after a report is made is less clear. New York and Illinois require their receiving bodies to review it, but none require the developer to investigate its own incident, nor assign investigatory powers to another actor. Developers therefore retain substantive control over what’s reported and what happens afterward, while state authorities have few tools to investigate. … The gap between a robust, aviation-style investigatory regime and current AI regulations is thus wide, whatever oversight architecture emerges. But these forensic preconditions for better regulation need not wait. Regulators can require that developers preserve what investigators need to reconstruct an accident: model weights, inputs and outputs, relevant logs, and operational conditions. … Regulators can also require large frontier developers to form dedicated units for managing this evidence and helping investigators access it.”
Analysis

Where this statement fits
Should Washington impose stronger safeguards on frontier AI?
Washington's frontier-AI safeguards dispute continued beyond September's calls for legislation. On September 29, Trump and six companies signed an accord covering internal controls, outside evaluations and board oversight, with possible later codification. Trump defended self-regulation and existing federal powers. Critics including Jon Stewart and Tom Wheeler argue that company-led oversight is insufficient. An October 9 task-force statement describes reporting and remediation as mandatory, but does not specify enforcement mechanisms or penalties. The question remains whether Washington's approach supplies adequate, enforceable safeguards while allowing continued AI development.
Source and context
Analysis
About this source
Signed analysis piece published by Lawfare on September 16, 2026 under its "Cybersecurity & Tech" and "States & Localities" topics. LaRoche reviews the shared incident-reporting scheme in California's SB 53, New York's Responsible AI Safety and Education Act and Illinois's SB 315, argues the laws create reporting duties but no investigatory regime, compares this with aviation accident investigation, and proposes two statutory preconditions: proactive evidence retention and dedicated in-firm units to preserve and interpret that evidence. The piece is addressed primarily to state regulators; it refers to Congress only in its closing paragraph ("the laws now on the books or introduced into Congress"). It describes enacted state law, pending California bills AB 1405 and SB 813, and industry proposals from Anthropic and Google, not enacted federal law. Its characterisations of interpretability limits and of the Hugging Face breach are the author's.
Before the quotation
The essay opens by crediting the three state laws with closing the knowledge gap between developers and government through incident reporting, published safety frameworks and, in Illinois, a mandatory annual independent audit. LaRoche then sets out the shared statutory scheme, a common four-part definition of "critical safety incident," reporting deadlines of 15 days in California and 72 hours in New York and Illinois, and argues the thresholds exclude important cases, citing a Hugging Face breach by OpenAI agents that he says might not qualify. The middle sections develop three forensic obstacles: model opacity, an evidentiary record that is distributed and mutable, and the firm's epistemic advantage, each contrasted with the Boeing MCAS investigation.
After the quotation
The closing paragraph states that if a formal investigatory regime emerges "from the laws now on the books or introduced into Congress", it will need to address AI forensic challenges carefully and creatively, and that the two proposed provisions would help ensure the evidence and expertise exist before a major accident. Immediately before the quoted recommendations LaRoche reviews competing oversight proposals, Illinois's third-party audit provision, California's pending AB 1405 and SB 813 auditor registry, Anthropic's June proposal for an independent evaluation ecosystem, and FINRA-style self-regulatory schemes proposed by Google and others, and says none addresses the forensic preconditions directly.
How this statement is classified
The label describes this statement's response within the context above.
Why this label?
LaRoche criticizes rules that leave companies controlling incident evidence and follow-up. He argues that independent investigators need powers and preserved evidence that current safeguards lack.
- Recorded on
- Published here
More from this case
Read the full caseMenin says company self-regulation is insufficient
“When the federal government fails to act, cities take the lead”Read statement
Stewart criticizes company-led AI oversight
“why can't we just ... slow this down rather than let people regulate something they have a clear conflict of interest in regulating?”Read statement
Sam Altman says the world should accept some bad things happening for AI's benefits
“we believe that the world should accept some bad things happening for the benefits of this technology and people having the agency.”Read statement
Share or embed this statement
The embed keeps its attribution link to The Dispute Index. Credit the image to The Dispute Index and link to the statement page.
Cite this record
- Publisher
- The Dispute Index
- Title
- Christopher David LaRoche says AI safety laws require incident reports but give regulators no way to investigate them
- First published
- Last updated
- Permalink
- https://disputeindex.com/events/948-in-a-september-16-lawfare-essay-christopher-david
Last updated marks the most recent saved version of this published statement.
The Dispute Index. "Christopher David LaRoche says AI safety laws require incident reports but give regulators no way to investigate them". First published: 2026-09-17. Last updated: 2026-10-12. https://disputeindex.com/events/948-in-a-september-16-lawfare-essay-christopher-david