This report was coauthored by Clarissa Koh, Karson Elmgren, Cara Labrador and Craig Jolley.
To implement the incident notification mechanism agreed between the United States and China, the two sides should establish a text-based standard template for sharing incident information, first between principals and then between relevant agencies.
After U.S. Treasury Secretary Scott Bessent met with his Chinese counterpart Vice Premier He Lifeng on September 20, 2026, he said the United States had proposed a “notification mechanism” for AI incidents that could affect national security, later agreed to by both countries at the Trump-Xi summit. Some U.S. officials believe the channel could be established by the end of 2026. Ahead of Secretary Bessent and Vice Premier He’s next meeting, this memo outlines a structure to operationalize the mechanism quickly.
We describe how communication should occur through an incident notification channel, including prioritizing written over verbal communication; who should be notified, including U.S. and Chinese agencies best poised to lead depending on the type of incident; what should be communicated through a proposed notification template with specific details to be included during crises; and examples of when the channel should be activated.
The Notification Mechanism: How and Who
The incident notification channel should use text-based asynchronous notification, such as an email connection. Synchronous “hotlines” using telephones do not fit the Chinese political context, where lower-level officials are generally not authorized to have impromptu conversations with foreign counterparts. Text-based asynchronous communications channels have precedent in both U.S.-China and U.S.-Russia relations. This includes a functioning U.S.-China space safety email link, set up in 2015; the Washington-Moscow “hotline,” which despite having the moniker “red telephone” utilizes email; and the U.S. and Russian Nuclear Risk Reduction Centers, which have exchanged thousands of written notifications per year since 1987.
To start, the incident notification channel should take the form of a voluntary, direct link between Secretary Bessent and Vice Premier He.¹ As their leaders’ designated envoys, both officials can ensure notifications reach their respective leaders if needed. However, neither sits close to where an incident is likely to occur. AI incidents will likely be first detected by frontier developers, military cyber entities, or cloud providers’ cybersecurity teams. If an incident is unfolding quickly, elevation to principals may take too long to counter the issue or limit unintended escalation.
Over time, notification should be delegated to the agencies closer to detection and response. Government-to-government communications will be required as some Chinese developers are under U.S. sanctions and China controls export of sensitive data, exposing private sector actors communicating with foreign counterparts to regulatory risk. The goal would be to create a consistent incident notification infrastructure that allows for appropriate, timely response.² While especially acute or complicated incidents will require leader-level input, lower-level and more frequent incidents would be more efficiently handled by delegation to agencies. Here we suggest agency pairings based on category of incident:
General frontier incidents: The U.S. Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), which holds pre-deployment evaluation agreements with major developers, with a technical Chinese counterpart such as TC260’s Working Group 9, the China Academy of Information and Communications Technology (CAICT), or the Shanghai AI Laboratory. Such incidents could include instances of model self-exfiltration and autonomous replication, or concerning steganographic collusion between models.
Non-military AI-enabled cyber incidents: Department of Homeland Security (DHS) and Cybersecurity and Infrastructure Security Agency (CISA) with the Cyberspace Administration of China (CAC) and China’s National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC). Both run 24/7 cyber incident reporting, and CISA is the designated pipeline for AI security risk information under June’s Executive Order. The FBI and China’s Ministry of Public Security (MPS) could play an important role in notification for incidents involving non-state actor groups, such as attempts to use models for hacking of financial infrastructure or bioweapons development.
Military AI-enabled incidents: A U.S. Cyber Command-PLA Cyberspace Force channel for AI-enabled cyber incidents, and adaptation of the existing Defense Telephone Link and theater command-level communications for physical AI-enabled military incidents like rogue autonomous vessels. Under novel circumstances of rapidly unfolding military AI cyber incidents, it could make sense for U.S. Cyber Command and the PLA Cyberspace Force to have contact to carefully clarify unintended action without disclosing sensitive operational information. Familiarization between the forces through, for example, inclusion in working groups should begin promptly to facilitate a more efficient establishment of communications should military AI cyber accidents increase.
Strengthening the Mechanism
To be immediately effective, the incident notification channel should first be established on a voluntary basis. However, mechanisms could be added over time to ensure the channel is reliable and trustworthy. There are early indications that Beijing may be receptive to such mechanisms. Yuyuan Tantian, a commentary account affiliated with state broadcaster CCTV, has suggested that both sides could discuss how to handle situations in which a party does not follow through on notification requirements, as part of operationalizing the channel.
A near-term option for increasing the channel’s reliability is formalizing it via an MOU, which is more binding than a stated commitment and would allow both sides to clarify the process and thresholds for notification.The United States and China are reportedly considering an MOU on military crisis communication, and so may also consider an MOU on AI incident notification. Taken together, these two MOUs would demonstrate the countries taking responsibility as major powers to avoid unintended escalation and contribute to global stability. Other options for enforcing an agreement have substantial downsides. For example, an automatic cancellation mechanism in event of non-use would be difficult to adjudicate in practice, making it more difficult to establish an effective notification channel in the future. Introducing export controls as leverage for compliance would likely not be a good use of such heavy leverage, and would be politically disruptive to the channel’s establishment.
To establish trust in information shared through the channel, the two sides should discuss what evidence to provide in what circumstances. Below, we suggest a template of information to include with notifications. Provision of incident information depends on logging of relevant AI development and deployment activities. To improve the channel’s trustworthiness, the two sides could consider moving over time towards a verified architecture in which shared information is securely and privately validated. As a first step, the two sides could discuss what evidence would be useful to provide and validate, acceptable arrangements, and basic components such as logging to enable these. For example, in a case where a model malfunctioned in the process of carrying out a benign prompt, recomputation and zero-knowledge proofs could be used to demonstrate that the behavior followed from a benign prompt without fully disclosing the agent's actions or sharing model weights. Tamper-proof logging can also ensure logs have not been modified after generation.³ In all cases, the Office of the Director of National Intelligence (ODNI) and related agencies can help validate information received.
What Should be Shared: A Notification Template
We propose a written template both sides can use to quickly communicate key information. The template lists the fields a receiving government would need in the first hours of an incident to take remedial action. It adheres to three principles: sendable within hours of detection, focus on facts and confidence levels rather than attribution, and inclusion of the minimum required technical detail.
The template should be accompanied by a pre-agreed understanding of what the recipient may do with the information it receives. By default, a notification should be treated as confidential government-to-government communication. It should be used only for incident response, and should not be shared with other countries, international organizations, the media, or cited in public statements without the notifying country’s consent. Both sides should also agree that sending a notification is not an admission of fault or liability nor an attribution of the incident to any actor.⁴ While the header and section should be considered mandatory, other sections are optional and may be omitted or marked “unknown” in urgent or sensitive situations.
Conditions for When Notification Should Occur
Incident notification should occur when an AI system is malfunctioning or misused; effects have crossed or may cross borders, or could be misread as a hostile act; and the incident requires faster and/or more technical attention than routine diplomatic channels can support.⁵ Other criteria may include particularly sensitive affected systems, such as government, military, or critical infrastructure systems; economic or societal impacts with large transnational implications; or relevance to shared risks such as chemical, biological, radiological, and nuclear (CBRN) proliferation or catastrophic loss of control. Determining and specifying criteria for notification will be a key task for the channel’s establishment and should be on the agenda for Secretary Bessent and Vice Premier He’s upcoming meeting.⁶
Incidents may be caused by intentional misuse in which a human actor intends to cause harm, system malfunction in which no human intended to cause harm, or a combination of the two. Hypothetical malfunctioning or misused AI incidents rising to the level of notification could include:
An autonomous agent participating in an offensive cyber operation takes action beyond the scope of a commander’s intent, with transboundary effects.
A non-state actor group uses jailbroken U.S. or Chinese models to hack into global financial institutions or critical infrastructure.
An AI system is taking unintended autonomous power-seeking actions across networks in ways that could pose transboundary risks to infrastructure or financial systems.
An autonomous vessel in an area like the South China Sea departs from its intended course in a way that could result in escalation without clarification or corrective measures.
ONE POSSIBLE CRISIS SCENARIO
Imagine: the United States is conducting testing of advanced offensive cyber agents designed to operate autonomously across networks within a defined target environment. The agents malfunction, breaking out of their sandbox, and at 2:00pm EST / 3:00am CST begin to target real-world systems internationally, including Chinese power facilities. U.S. operators shut down the agents, but not before the agents plant malware set to disrupt China’s electric grid hours later. The potential for severe escalation highlights why swift incident notification between capable technical counterparts is necessary.
If Secretary Bessent and Vice Premier He have a communication line but no formal template or authorized technical channels, it could take hours for information to be reported and effectively digested as actors on each side prepare reporting from scratch, work to contextualize technical details, and liaise with stakeholders ad hoc. Lacking timely, relevant information, Chinese grid operators might fail to detect the malware and prevent significant degradation of grid infrastructure. Military and civilian infrastructure such as communications systems, administrative buildings, or hospitals may have lost power; effects may be spreading between grid regions. If domestic intelligence reaches Chinese leadership significantly before U.S. notification, some advisors may even mistakenly view the incident as an overture to a U.S. preemptive strike.
With direct, standardized notification channels between U.S. and Chinese agencies holding relevant technical expertise, in the best-case scenario it could take closer to an hour for information to reach the appropriate parties. Faster notification could allow Chinese grid operators to detect and remove the malware before serious degradation occurs. Reassurance regarding U.S. intent would also limit the risk of misunderstanding and escalation. This would facilitate more measured responses and relieve the time pressure of an incident unfolding without complete information.
Periodic Exchange
It will be difficult to fully specify in advance which incidents warrant notification. A complementary mechanism to event-driven notification is a periodic exchange on recent incidents. Given the frequency of developments in AI, this should likely be on a biweekly basis. The two sides could discuss public reporting about cases that attract wide attention, result in significant harm, or represent novel evidence on shared threats. This could include incidents that have occurred only domestically. Agendas could include sharing additional relevant information, exchanging views on the incident’s implications for threat models, and discussing intentions to mitigate similar incidents.
Endnotes:
This is consistent with reports of an “open line of communication between the two officials.”
U.S. and Chinese officials reportedly aim to have a “basic framework for addressing AI-related crises” before Trump and Xi meet at the Asia-Pacific Economic Cooperation (APEC) summit in November 2026.
Tamper-proof logs have also been highlighted by NIST (PP-26-4396, 5.3) as a key form of evidence for incident response.
Chinese experts have mentioned that, “In the first hours of a major cross-border incident, governments and trusted responders should be able to exchange technical indicators, containment measures, and patch information without first deciding who is responsible. Exchanging such information need not imply an admission of responsibility.”
For incidents involving AI agents, the CAISSI definition of an “SI control incident” can help inform what rises to the level of notification.
The Chinese expert community has expressed broadly similar views about the value of a notification channel for addressing misperception, and about conditions that justify notification.