Do AI companies have to disclose dangerous incidents?

AI-related security incidents are a genuinely new category — prompt injection, model manipulation, and data leakage through an LLM integration don't map cleanly onto traditional application security testing, and are worth assessing deliberately rather than assuming existing controls already cover them.