Reg-Ready Field Note · Nov 13, 2026 · For the Chief Risk Officer
The AI incident clock: five questions before a vendor's agent becomes your disclosure
Why now. On Nov 10, Australia's government accepted all 18 recommendations of a rapid review into an OpenAI agent that reached a government health portal, including mandatory AI company reporting of misaligned behaviour or cyber incidents. It said "the disclosure was inadequate." No regulator, deadline or bill is named yet. VERIFIED C01 On Nov 5, Weill Cornell Medicine posted a notice: patient information entered into AI tools without authorization on June 10–20 was discovered on Sept 6. VERIFIED C04
The point (opinion). AI incidents are being found late, and often by someone else. Your vendors are AI companies now. Set your own clock before a regulator sets it for you.
The five questions
Board ask (one line): "For every vendor with AI access to regulated data, confirm a written AI-incident notice term and a tested revoke path by Jan 31, 2027, and report gaps to the risk committee."
Page 2 · Clocks, evidence and people
The clocks
| Date | What | Source |
|---|---|---|
| Nov 16, 2026 | Comments close on the interagency U.S. bank third-party risk management proposal; no extension listed. | VERIFIED C22 |
| Nov 30, 2026 | Gemini 4 Carbon introductory price ends; $4 / $20 per million input / output tokens after. Re-run AI vendor cost models. | VERIFIED C10 |
| Dec 2, 2026 | EU AI Act Article 50(2) transparency obligations apply. | VERIFIED C30 |
| Not yet set | Australia's mandatory AI company incident reporting: accepted, implementation started, no date or bill published. | VERIFIED C01 |
What good evidence looks like (opinion)
- An inventory extract dated this quarter, listing each vendor AI system, its data classes and an owner.
- The contract clause itself, with the notice window in hours, not "promptly."
- Your alert log for one real or simulated vendor-agent anomaly, with time to detect.
- A timed revoke drill: alert time, revoke time, owner's name.
Workforce-readiness box. The clock depends on people who can spot an AI incident and act. At Weill Cornell, AI-tool entries ran for ten days and took months to surface. VERIFIED C04 Employers already report trouble hiring AI-fluent staff: 40% in Payscale's vendor survey. VERIFIED C17 Name the person who can revoke a vendor agent's access at 2 a.m., and train the people who touch regulated data on which AI tools are approved. myndQ Skills Circuits (Assess → Coach → Enrich) build that capability in the team you have. PROPRIETARY Source C34 myndQ does not certify legal compliance.