No central AI incident reporting and investigation function

CLTR identified the gap in 2024 and it remains unfilled: DSIT has no central, live picture of AI incidents in the UK. Aviation has the AAIB, medicines have the MHRA Yellow Card scheme, and workplace safety has mandatory regimes; AI has none. Fragments sit with individual regulators, failures of government's own AI tools have no mandatory reporting route, and misuse incidents in fraud and disinformation are counted by nobody.

Without incident data the state cannot detect patterns, coordinate responses to a major AI failure, or catch early warnings of larger-scale harms, the blindness that preceded past regulatory disasters in other sectors. It is also the cheapest single preparedness measure available.

A central AI incident database run by DSIT and AISI with a statutory reporting duty on public bodies and thresholds for private-sector reporting. Longer term, an AI incident investigation branch modelled on the Air Accidents Investigation Branch, with no-blame investigative powers.

// State-led: Instrument: statutory reporting duty and DSIT/AISI-run database; investigation branch later.

Aviation and medicines run mandatory incident regimes while AI has none; the database is the cheapest preparedness measure and has been wholly unowned since 2024.