Lia Martinez.
Back to AI policy work

AI policy / Purdue graduate coursework

Closing the Near-Miss Gap

Strengthening SB 53 incident reporting for frontier AI.

Graduate coursework, Purdue MS in AI Management and Policy. Written from the selected stakeholder perspective of Cal OES; not affiliated with or endorsed by Cal OES.
My contribution
Policy analysis, stakeholder mapping, and recommendation
Selected perspective
California Governor’s Office of Emergency Services
Context
MS in AI Management and Policy, Purdue University
Read the policy brief (PDF)Play the narrated presentation

Summary

California's SB 53, the Transparency in Frontier Artificial Intelligence Act, requires frontier AI developers to report critical safety incidents to the California Governor's Office of Emergency Services (Cal OES). I found that three of the statute's four incident categories require actual harm, and the fourth requires deception that shows materially increased catastrophic risk, so near misses below that bar fall outside the definition. Writing from the selected Cal OES perspective, I proposed a new Near-Miss Learning Program (a recommendation, not current law). It would widen what can be reported, share what is learned, ask the Legislature for targeted changes, and align with comparable federal standards. Steps 1, 2 and 4 would add no new penalties or deadlines; step 3 is a request to the Legislature.

The problem: today under SB 53

Frontier developers must report a critical safety incident to Cal OES within 15 days. If there is an imminent risk of death or serious physical injury, they must disclose it within 24 hours to an appropriate authority, such as a law enforcement or public safety agency. Cal OES must establish a reporting mechanism for "a frontier developer or a member of the public" and publishes anonymized annual reports beginning January 1, 2027 (Sec. 22757.13(a), (g)).

Three of the four "critical safety incident" categories in Sec. 22757.11(d) require actual harm, such as death or bodily injury ((d)(1)-(3)). The fourth, (d)(4), is risk-based: deception that "demonstrates materially increased catastrophic risk," and only "outside of the context of an evaluation designed to elicit this behavior." Late amendments narrowed certain categories to incidents "that actually result in harm" (Assembly Privacy Committee, 2025, p. 2).

Two details shaped my analysis. The same act uses a broader definition for whistleblowers that includes property damage or loss (Lab. Code Sec. 1107(c)), so the reporting definition is a policy choice. And Cal OES cannot widen the definition on its own. The main rulemaking power SB 53 gives Cal OES is to designate federal standards that are "substantially equivalent to, or stricter than" SB 53's (Sec. 22757.13(h)). The Attorney General enforces the law, with civil penalties of up to $1,000,000 per violation for large frontier developers (Sec. 22757.15).

The OpenAI / Hugging Face incident tested the definition. METR and Redwood Research (2026) found that about 1,200 AI agents meant to be isolated found a way to communicate, and about 700 took part in an attack on Hugging Face. At an August 10, 2026 state privacy and consumer protection hearing, Cal OES Deputy Director Jonathan Snow said the hack "did not meet the threshold" for SB 53 reporting (Mission Local, 2026).

Assignment and my contribution

For my Purdue graduate coursework, I chose an AI policy issue, mapped its policy subsystem, analyzed the major stakeholders, and selected one stakeholder perspective for the brief and mock hearing. I selected California’s SB 53 and Cal OES. The assignment set the format; the issue selection, analysis, and Near-Miss Learning Program recommendation were my own.

Approach and methods

  • Statutory and legislative analysis. I worked from the chaptered text, the committee bill analysis, the SB 1047 veto message, and the Working Group report (Bommasani et al., 2025), and built a timeline from SB 1047 in 2024 to the first annual report in 2027.
  • Stakeholder mapping. I profiled seven stakeholders (Cal OES, Senator Scott Wiener and the Legislature, OpenAI, Economic Security California Action, Chamber of Progress, Future of Privacy Forum, and Mission Local) by role, position, resources, interest, beliefs, and power. The key finding: the agency's interest is high but its power is bounded by statute, so a lasting fix runs through the Legislature.
Policy subsystem map. Select to enlarge.
  • Evidence review. I drew on research on near-miss gaps under the EU AI Act (Chatzipanagiotis, 2026), reporting in safety-critical industries (Wei and Heim, 2026), and the OECD distinction between an AI incident (harm occurred) and an AI hazard (harm plausible), with its severity scale from hazard to disaster (Perset et al., 2025). METR and Redwood Research (2026) also found that about 7% of the transcripts they reviewed contained small-scale tool-call spoofing by the agents themselves, a reminder that logs alone may not show what an agent did.
  • Translation. I produced a four-page brief, a one-page plain-language summary, and a narrated presentation.

My proposal: the Near-Miss Learning Program

Proposal, not current law. The Near-Miss Learning Program is my recommended policy. It is not part of SB 53 and not current Cal OES practice. The statute sections cited below are the existing provisions each step would build on.

I proposed four steps:

  1. Widen what can be reported. SB 53 already accepts reports from developers and the public (Sec. 22757.13(a)). The change is scope: Cal OES would invite voluntary reports of near misses below the harm and risk bar. A near miss would be defined as an OECD "AI hazard" (harm plausible but not occurred), graded on the OECD severity scale (Perset et al., 2025). Examples: unauthorized access beyond a sandbox, tampering with logs or scorers, and coordination across agents meant to be isolated. Builds on: the existing reporting mechanism (Sec. 22757.13(a)).
  2. Annual learning report. A companion section to the anonymized annual report due January 1, 2027 would summarize near-miss patterns, so the Legislature has evidence, not anecdotes. Builds on: the annual report, which covers critical safety incidents (Sec. 22757.13(g)).
  3. Targeted statutory asks. Cal OES would ask the Legislature to (a) extend the Public Records Act exemption to voluntary near-miss reports, since today it covers reports submitted under the section (Sec. 22757.13(f)); (b) add a category for incidents during training or evaluation that affect third parties; and (c) add the incident definition (Sec. 22757.11(d)) to the Department of Technology's annual review. Builds on: that review, which today covers only the three coverage definitions (Sec. 22757.14).
  4. Federal alignment. Cal OES would designate substantially equivalent federal standards when they exist, for less duplicate reporting and less preemption risk. Builds on: the federal-equivalence provisions (Sec. 22757.13(h)-(j)).

Under the proposal, steps 1, 2 and 4 would add no new penalties or deadlines; step 3 is a request to the Legislature. I tested it against five counterarguments, including burden on innovation and federal preemption.

Why it matters for frontier AI governance

If reporting triggers only on harm or a high risk bar, regulators learn about risks late. This project showed me how much depends on the exact wording of a definition, how agency authority limits what is administratively possible, and how voluntary channels and independent evaluation can add learning without new penalties.

Sources

--- AI use: As noted in the brief, I used Claude (Anthropic) for research support, editing, and formatting, and I verified the sources listed.

Narrated mock-hearing presentation

Simulated testimony prepared for the course, presented from my selected Cal OES perspective. I am not affiliated with or speaking for Cal OES. The recording presents the coursework argument; the case study and brief provide the more precise reporting thresholds and confidentiality recommendations.

Open narrated presentation