AI Incidents Are Growing Globally but No Country Records Them the Same Way
What happened
In early 2024, a French woman believed she had struck up a correspondence with Brad Pitt. The person she was talking to was not him. The fraud used AI-generated imagery and messaging to sustain the deception, and by the time it unraveled, recovering her money remained an open question. When the case reached the attention of European regulators, it had become a reference point in a different argument: not about celebrity impersonation specifically, but about whether any country's reporting infrastructure could capture what had happened in a form useful to any other country.
The OECD published an analysis in March 2025 arguing for a standardized framework for documenting AI incidents. The core finding was not that harm was hard to identify. It was that harm was being recorded inconsistently, jurisdiction by jurisdiction, in formats that blocked coordinated response. France alone logged over 130,000 online scams in 2023, an 8 percent increase from the previous year. That figure captures only what was reported through official channels, under one country's definition, in one category of harm.
The analysis surveyed several other harm categories where the same documentation gap appears. A major technology company scrapped its AI-powered hiring tool after it was found to systematically disadvantage applications from women. A healthcare algorithm was directing resources toward White patients over Black patients by using cost as a proxy for medical need rather than measuring need directly. Researchers intervened and reduced the bias by over 80 percent, but the flaw was identified through internal observation, not through any cross-institutional reporting process that might have flagged the same pattern elsewhere before deployment.
The OECD's response was a common reporting framework built around 29 mandatory criteria, organized across eight dimensions covering economic context, type of harm, severity, technical details of the system involved, and the causal connection between system outputs and the incident. The criteria were selected from 88 possible characterization points drawn from four existing resources, including the AI Incidents Database and the OECD's own AI Incidents Monitor. The stated purpose is to help policymakers compare incidents across borders, align regulatory responses, and build shared knowledge rather than reacting case by case.
What the framework is trying to close is the gap between harm happening and harm becoming legible across institutions. When a biased healthcare algorithm is corrected in one country and never documented in a reusable form, an identical system elsewhere starts from zero. A provable record of what a system did, what it was trained on, and what downstream effect followed is the minimum input for coordinated governance. Without that record, the same design errors recur across new jurisdictions, and every regulator is effectively encountering AI-caused harm for the first time.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.