A hospital does not have to report a device malfunction. The manufacturer does. And if a device may have caused a death, the hospital reports it to the FDA and to the manufacturer both, inside ten working days.

That split looks strange until you see what it is built on. It is not about fault. It is about who can see what.

The manufacturer has thirty days to tell the FDA when it learns a device may have caused a death or a serious injury, or that a malfunction would likely cause one if it happened again. Five working days when the event needs remedial action. The manufacturer carries that load because only the manufacturer knows what went into the unit, which batch the parts came from, and whether the same thing is showing up somewhere else.

The facility carries the other half, because the manufacturer cannot see the bedside. A death goes to the FDA and the manufacturer. A serious injury goes to the manufacturer. Ten working days.

Neither half works alone. Traceability with no field reports has nothing to trace. Field reports with no traceability cannot be tied to a cause. The device world took decades and a statute to work that out.

Now look at where AI is.

The first half is starting. The software labs have begun publishing incident reports about their own models.

The second half does not exist. Nothing requires the company running an agent to write anything up. Not when it produces a bad output. Not when somebody catches it. Not when the same thing happens twice.

And the company running the agent is the only party that can see it happen. The vendor knows its platform. It does not know what you configured, who you gave access to, what you asked the thing to do, or what your people did with the answer. That is the half that usually explains the incident, and it is the half nobody is obligated to record.

No statute is coming soon. So the question is whether you build it before one arrives or after.

What it takes is smaller than it sounds. Name AI behavior as reportable in the incident plan you already have, the same as any other failure. Decide what goes to the vendor, who sends it, and how fast. And write down what happened, how it was resolved, and what changed so it does not happen again.

That last part is not new. It is what an incident report has always been.

Over the last month I have written about who notices when something goes wrong, who owns the exceptions nobody documented, who supervises an agent the way you would supervise a person, and what a record has to hold to be traced at all. This is the last one, and it is the simplest. Somebody has to write it up.

If an agent at your company produced a bad output last month, is there a document somewhere that says so?