When a flaw surfaces in a deployed AI system, the operators’ first question is rarely how bad is it. It is who do I even tell. For most systems fielded today, the honest answer is: no one, through no defined channel, under no protection for the person who found it. That silence is not a gap in someone’s runbook. It is a property of the architecture — one chosen by omission the moment the system shipped without a place to send its flaws.
Treat that as the starting point. Every deployed AI system already ships with a disclosure policy — the default one, the one no one designed, and it reads: tell no one. A disclosure surface is not paperwork you attach after launch; it is structure, and a system built without one has not deferred the decision. It has made it.
The gap has a shape
The fragmentation is not anecdotal. A 2026 audit of twelve AI flaw-reporting systems found the ecosystem failing along five consistent axes — discoverability, scope, information collection, coordination, and guidance on strict-liability exposure — and proposed an open, interoperable reporting instrument to close them [1]. That the same five failure modes recur across all twelve independent systems is not a run of unlucky implementations. It is a category-level design absence, reproduced independently because no one built the surface into the substrate.
The shape matters for architects because each axis maps to a decision made at design time. Discoverability is a routing decision. Scope is a contract decision. Information collection is a schema decision. Coordination is an interface decision. Strict-liability guidance is a governance decision. None of these is patchable after the fact without touching the system’s structure — which is precisely why they keep getting skipped.
State it concretely, because surface should name a component an architect can build Monday morning, not a metaphor. An enterprise disclosure surface minimally requires an intake endpoint, a canonical schema, a routing engine, protected reporter identity, trace linkage back to the system’s own runtime records, and an evidence store. Each has an owner, an interface, and a failure mode. None of the six appears by accident; every one is either designed in or absent — and the sixth, trace linkage, is where this series is ultimately headed, because for an agent it reaches all the way into what the system chose to remember while it ran.
Software already solved the first version of this
The discipline that AI is rediscovering has a name and a lineage. Coordinated Vulnerability Disclosure (CVD) — the norms, timelines, and safe-harbor conventions that govern how software flaws move from finder to fixer — is decades mature, codified in the CERT Guide to Coordinated Vulnerability Disclosure (CMU/SEI) and extended to machine-learning systems in Householder and colleagues’ Lessons Learned in Coordinated Disclosure for AI/ML Systems. The software field also learned to separate two things architects routinely conflate: disclosure, where a finder reports a flaw and a coordinated fix follows, versus notification, where affected parties are simply told. A 2025 meta-review of CVD practice draws that line explicitly and studies how to reach the right stakeholders at scale [5].
The AI-native translation arrived in 2024. Cattell, Ghosh, and Kaffee named the pattern Coordinated Flaw Disclosure (CFD) — deliberately broader than “vulnerability,” because AI failures include bias, unsafe outputs, and capability surprises that no security-only frame captures — and proposed the machinery to run it: extended model cards, dynamic scope expansion, an independent adjudication panel, and automated verification [3]. That paper is the intellectual headwater. The move from CVD to CFD is the move from “flaws are security bugs” to “flaws are anything the system does that it should not,” and the architecture has to widen accordingly.
Why in-house evaluation isn’t enough
The reflexive enterprise answer — we evaluate our own models — is where the architecture gap hides in plain sight. In-house evaluation is necessary and structurally insufficient: the party that built and benefits from a system is the wrong sole judge of its flaws, and finders outside the organization have no safe, standardized way in. A 2025 analysis of general-purpose AI made the case directly and prescribed three interventions: standardized flaw reports paired with clear rules of engagement; broadly scoped disclosure programs backed by legal safe harbors; and coordination infrastructure to move a report to everyone who needs it [2]. Read those three as an architecture spec, not a policy wish list — each is a component with an interface, and each is absent by default.
This is also why the auditing ecosystem, on its own, does not close the gap. A field scan of algorithmic auditing found the practice real but uneven, and recommended standardized harm-incident reporting and response as connective tissue the ecosystem lacks [4]. Auditors can only act on what surfaces to them; without a disclosure surface, the audit inherits the same blind spot as the vendor.
The gap is structural, not procedural
Put the four together and the diagnosis is unambiguous. The CFD model exists [3]. The intervention set is specified [2]. The interoperable instrument is built and audited [1]. The auditing layer is asking for exactly this connective tissue [4]. What is missing in most deployed systems is not the idea, the standard, or the tooling — it is the decision to make the surface a first-class part of the architecture instead of a form someone might add later.
Procedural fixes fail here for the same reason a bolt-on security control fails: if the system was not designed to emit, route, and protect flaw reports, no process wrapped around it can retrofit those properties without re-entering the design. The gap compounds for a concrete reason — every deployment shipped without a disclosure surface converts architecture debt into governance debt. The missing components don’t stay conveniently missing; the system gets built around their absence, so the cost of adding them later is the cost of re-opening everything built on top.
The reporting gap is not a policy gap to be filled later. It is an architecture gap, and it compounds. A system with no disclosure surface has already decided who is allowed to see its flaws — and the default answer is no one.
Architects who treat disclosure as a launch-time structural requirement pay once. Everyone else pays continuously, and pays most at the moment a flaw becomes a headline.
Part 2 takes the next layer: once a report has somewhere to go, what turns it from an individual incident into evidence a board can act on.
