Christopher David LaRoche
Role at the time: Assistant professor of international relations at Central European University and Carnegie Endowment Stanton nuclear security fellow, writing a signed analysis piece for Lawfare
Statement summary
In a September 16 Lawfare essay, Christopher David LaRoche argued that the current generation of AI safety laws, California's SB 53, New York's Responsible AI Safety and Education Act and Illinois's SB 315, is an advance but stops at incident reporting. He wrote that none of the three requires a developer to investigate its own incident or assigns investigatory powers to any other actor, leaving developers in control of the evidence and regulators without the means to reconstruct what happened. He identified three obstacles specific to AI: model opacity, evidence that is distributed and mutable, and firms' epistemic advantage over outside investigators. He proposed two statutory requirements that he said need not wait for a formal investigatory regime: a proactive data-retention duty covering model weights, inputs and outputs, logs and operational conditions, and dedicated in-firm units to preserve that evidence and help investigators interpret it. His comparisons with aviation accident investigation and his reading of interpretability limits are his own analysis.
“What happens after a report is made is less clear. New York and Illinois require their receiving bodies to review it, but none require the developer to investigate its own incident, nor assign investigatory powers to another actor. Developers therefore retain substantive control over what’s reported and what happens afterward, while state authorities have few tools to investigate. … The gap between a robust, aviation-style investigatory regime and current AI regulations is thus wide, whatever oversight architecture emerges. But these forensic preconditions for better regulation need not wait. Regulators can require that developers preserve what investigators need to reconstruct an accident: model weights, inputs and outputs, relevant logs, and operational conditions. … Regulators can also require large frontier developers to form dedicated units for managing this evidence and helping investigators access it.”
Signed analysis piece published by Lawfare on September 16, 2026 under its "Cybersecurity & Tech" and "States & Localities" topics. LaRoche reviews the shared incident-reporting scheme in California's SB 53, New York's Responsible AI Safety and Education Act and Illinois's SB 315, argues the laws create reporting duties but no investigatory regime, compares this with aviation accident investigation, and proposes two statutory preconditions: proactive evidence retention and dedicated in-firm units to preserve and interpret that evidence. The piece is addressed primarily to state regulators; it refers to Congress only in its closing paragraph ("the laws now on the books or introduced into Congress"). It describes enacted state law, pending California bills AB 1405 and SB 813, and industry proposals from Anthropic and Google, not enacted federal law. Its characterisations of interpretability limits and of the Hugging Face breach are the author's.
Why we used this label
LaRoche criticizes rules that leave companies controlling incident evidence and follow-up. He argues that independent investigators need powers and preserved evidence that current safeguards lack.