AI Incident Monitoring through a Public Health Lens

Public databases of AI incidents are growing rapidly, but incident counts alone cannot measure risk: they mix true harm rates with deployment scale, reporting lag, and media attention. Borrowing from public-health epidemic surveillance, we propose a six-phase lifecycle framework for AI incidents and test it in two domains. In autonomous vehicles, California DMV mandatory-reporting data provides an external ground truth; AIID-only phase inference agrees with DMV at near-chance levels (Cohen's $\kappa = 0.062$), while expert reading of the same data recovers regime boundaries the statistics miss. In deepfakes, where no ground truth exists, changepoint analysis identifies a single governance-relevant transition in March~2022, after which risk sits at $+0.43\sigma$ above baseline for 43 consecutive months with no return to the earlier regime. Both cases show that statistical pipelines applied to incident databases alone are insufficient: the AV case requires expert reading to recover regime structure, and the deepfake case shows that even a robust phase estimate cannot produce action without institutional structures to respond. The framework's contribution is structuring expert judgment, not replacing it.