Is an operator anywhere required to report that an agent acted beyond its authority?

No settled answer exists. The ledger poses the question, links the live debate, and does not answer it.

Record ID

AIL-2026-0033

Kind

Open question

Jurisdiction

European Union

Last verified

15 September 2026

Added

15 September 2026

• Article 73 requires providers of high risk AI systems placed on the Union market to report any serious incident to the market surveillance authorities of the member states where it occurred.
• The duty attaches to the system's risk classification, not to whether an agent acted outside its mandate.
• Reports go to authorities, not to a public register, so an operator learns nothing about incidents at comparable deployments.
• The main United States federal instrument for AI risk states that it is intended for voluntary use, and describes no reporting duty or intake mechanism.
• This ledger found no regulator anywhere publishing incident guidance specific to agents.

Accountability, Logging and audit. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

AccountabilitySilent

A legal duty exists in one jurisdiction for one class of system, and nothing obliges disclosure when an agent exceeds its authority.European Commission AI Act Service Desk, Article 73 on reporting of serious incidents, primary source, 15 September 2026.

Logging and auditOpen

No regime requires an operator to keep a record that would let anyone reconstruct what an agent did on their behalf.NIST, AI Risk Management Framework, primary source, 15 September 2026.

Do not wait for a duty to arrive before you can answer the question. Decide now what your organisation counts as an agent incident, who it is reported to internally, and within how many hours. If you place a high risk system on the European market you already have a real clock to meet, and the practice that meets it is the same practice that tells you what your agents did.

1. European Commission AI Act Service Desk, Article 73 on reporting of serious incidentsPrimary · 15 September 2026
2. NIST, AI Risk Management FrameworkPrimary · 15 September 2026

• Open questionOpen questionAIL-2026-0035

  Does any registry classify AI incidents by the authority control that failed, and does anyone count agent incidents?

  Global · verified 15 September 2026

  The AI Incident Database describes itself as indexing the collective history of harms or near harms realised in the real world by deployed AI systems.

• Open questionOpen questionAIL-2026-0034

  Who is liable when an agent commits its principal to something false or binding?

  Global · verified 15 September 2026

  The Canadian tribunal decision is a small claims level decision and is not binding precedent on other courts.

• VerifiedFabricationAIL-2026-0030

  A German appellate court held a company to specialist titles its chatbot invented, and allowed a further appeal

  European Union · verified 15 September 2026

  The court's press release records that the chatbot told users the company's two doctors held several specialist titles, including titles that do not exist.