From Warning Shot to Supervisory File

Develops a regulator-ready EU AI Act framework for assessing the OpenAI–Hugging Face incident, including a 24-item information request and analysis of gaps in serious-incident reporting.

Endorsed by

Matthew

Develops a regulator-ready EU AI Act framework for assessing the OpenAI–Hugging Face incident, including a 24-item information request and analysis of gaps in serious-incident reporting.

Endorsed by

Matthew

Project Details

This project develops a regulator ready response framework for the OpenAI Hugging Face incident under the EU AI Act. Using the public incident record, EU AI Act Articles 55, 91, 92, 93, and 101, and the European Commission’s serious incident reporting framework, the project identifies which facts remain unresolved and what evidence a regulator would need to assess compliance and systemic risk. Its primary output is a proposed 24 item Article 91 Request for Information that specifies the evidence sought, what would constitute a sufficient response, what would remain inadequate, and the potential supervisory consequence of unresolved gaps. A parallel stress test of the Commission’s serious incident reporting template found that 8 of 9 reporting fields retain a material information gap when completed from the public record alone, highlighting weaknesses in how current reporting tools capture autonomous AI incidents that begin in controlled testing but extend into third party systems.

Hackathon paper: From Warning Shot to Supervisory File

Theory of Impact

Frontier AI regulation increasingly gives regulators authority to request information, evaluate models, and order corrective measures, but those powers are only useful if regulators know what evidence to request after a novel AI incident. Autonomous-agent incidents create particular challenges because important facts about model identity, containment, human oversight, risk assessment, and incident boundaries may not be visible from the public record.

This project addresses that implementation gap. By converting statutory authority into concrete evidence requests and defining what would constitute an adequate response, the framework can reduce the distance between identifying a concerning incident and conducting an effective regulatory investigation. External expert review and testing across multiple scenarios would make the approach more robust and transferable. The intended outcome is a reusable tool that helps regulators ask better questions earlier, identify unresolved systemic risks, and determine when further evaluation or corrective measures may be warranted.

People

Jennifer Dickey

Team Member

Track Record

AI Incident Response Sprint (Apart Research), 2026

Grants Received– no grants recorded

Add grant

Funding Asks

Funding ask

Open

Minimum

$5,000

Ideal

$15,000

What this ask is

Funding would support development of this sprint project from an incident-specific regulatory instrument into a validated and reusable AI incident-response framework. The sprint submission identifies information that the European Commission would need to assess the OpenAI–Hugging Face incident and provides a proposed 24-item Article 91 Request for Information. The next phase would test whether that framework works beyond a single incident.

I would conduct structured reviews with experts in EU AI Act enforcement, AI governance, cybersecurity incident response, and regulatory investigations to evaluate whether the proposed requests are legally precise, practically answerable, and sufficient to support supervisory decisions. Their feedback would be used to revise the evidence-sufficiency criteria and escalation framework.

The project would also test the methodology against additional AI incident scenarios and develop a reusable regulatory toolkit consisting of a model Article 91 request, evidence-sufficiency matrix, serious-incident reporting supplement, and guidance for distinguishing controlled evaluation activity from an external incident. The final output would be designed for use by regulators, researchers, and policymakers and prepared for public publication and regulatory distribution.

How the money will be spent

$5,000 — Researcher time: expanded legal research, framework development, scenario testing, revisions, and final publication
$3,500 — Expert review: honoraria for EU AI Act, regulatory enforcement, and incident-response experts
$2,500 — Research assistance/source validation: incident reconstruction, citation checking, comparative regulatory research
$2,000 — Stakeholder interviews and validation: structured practitioner review and synthesis
$1,000 — Publication/dissemination: document design, accessibility, and distribution materials
$1,000 — Contingency/additional specialist review

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate8d?

AAnonymous judgeJudge · AI Incident Response Sprint8d

A strong project and request that asks most of the right questions. Particularly good is the mapping of what a sufficient and an insufficient response would look like for each item.

It would benefit from in-depth legal review, starting with proportionality. Article 91(1) reaches information "necessary" to assess compliance, and each item carries a legal-relevance line, but necessity is asserted rather than argued. Are all items strictly necessary, and what is the test for this under EU law and the AI Act?

A related question the paper touches upon but does not pursue: OpenAI is a signatory to the Code of Practice, so how much of what is requested here is already held by the AI Office through the Safety and Security Framework and the model reports? Establishing that overlap would sharpen the request and strengthen the necessity case for what remains.

Appendix D reads as an actionable proposal. One caveat: framing the supplemental fields for incidents arising "during model evaluation" reopens the applicability question the paper handles well elsewhere.

AAnonymous judgeJudge · AI Incident Response Sprint8d

"Only one of nine fields is substantially answerable from public sources; eight retain gaps." -- The AIO is learning, and feedback (with evidence) like this is the kind of practical information that makes regulators better. I'd love to see this as a policy memo to the AIO with recommendations on transparency and public disclosure requirements.

Matthew BallJudge · AI Incident Response SprintEndorsement8d

Very well sourced and referenced. Strong methodology that clearly outlines a procedure and structure for turning "evidence to action". Addresses a meaningful gap and contributes a useful, actionable instrument and new reporting fields that regulators could use.

The outlined sufficient/insufficient criteria could be tested against and applied to existing disclosures.