Does EO 14409 — Promoting Advanced Artificial Intelligence Innovation and Security require Incident Reporting?

United States • voluntary

Yes — 1 provision

Requirements at a glance

This regulation imposes 4 specific requirements for Incident Reporting across 1 provision:

AI Cybersecurity Clearinghouse for Vulnerability Coordination #

Obligation:
Incident Reporting
voluntary
Effective:
Jun 2, 2026
Risk tier:
all
Scope:
providers
cross-domain
The White House launched the clearinghouse as GOLD EAGLE on 2026-07-14. Open-source software partners and critical-infrastructure companies built the coordinated system, which had already begun receiving and prioritizing vulnerabilities from across sectors, coordinating scanning verification, and distributing prioritized threat and remediation information. Participation remains voluntary and creates no reporting mandate.

Requirements

RequirementDetails
Vulnerability intake and prioritizationGOLD EAGLE receives identified cybersecurity vulnerabilities from across industries and sectors and prioritizes action
Coordinated scanning verificationGovernment and industry coordinate scanning verification and reduce duplicative scanning
Remediation informationGOLD EAGLE distributes prioritized and actionable threat and remediation information to federal and private-sector defenders
Patch coordinationOpen-source software and critical-infrastructure participants coordinate to receive and patch vulnerabilities

Penalties

ViolationFine
N/AVoluntary collaboration; no penalties. General provisions create no enforceable rights.
View full regulation View obligation Obligation matrix