Database
AI incidents database
24 documented AI incidents from 2016 to today — bias lawsuits, deepfake fraud, hallucination sanctions, autonomous-vehicle deaths, and regulator actions. Every case links to a primary source (court docket, regulator filing, or investigative reporting). No fabricated entries.
Cross-index: many entries also appear in the OECD AI Incidents Monitor and AI Incident Database. Last updated August 2026.
Chronological
Most recent first
| Date | Incident | Sector | Status | Source |
|---|---|---|---|---|
| 2025-11 | NYT v. OpenAI — 20M ChatGPT logs ordered produced OpenAI · US (SDNY) Magistrate Judge Ona T. Wang ordered OpenAI to produce a de-identified 20 million-log sample of ChatGPT conversations to NYT. District Judge Sidney Stein affirmed the order on Jan 5, 2026. The earlier May 13, 2025 mass preservation order was lifted Sept 26, 2025. Landmark AI-discovery ruling. Privacy breach | Consumer / generative AI | Ongoing | Reuters |
| 2025-05 | Mobley v. Workday — AI hiring ADEA collective certified Workday · US (ND Cal) Judge Rita Lin granted preliminary ADEA collective certification against Workday itself, treating its AI screening tools as an "agent" of employers under Title VII / ADEA. On July 7, 2025 the court further held HiredScore AI features are covered by the collective. Case ongoing as of Dec 2025. Discrimination | Employment / HR | Ongoing | Civil Rights Clearinghouse |
| 2024-05 | Slack — AI training on customer messages backlash Slack (Salesforce) · US Users discovered Slack trained ML models on customer messages by default; opt-out was email-only. Salesforce updated policy and clarified GenAI (Slack AI) uses hosted models with no training. Case study in default-privacy design. Privacy breachReputational | Consumer / generative AI | Resolved | The Verge |
| 2024-03 | NYC MyCity chatbot advises businesses to break the law City of New York · US (NYC) Microsoft-powered MyCity chatbot advised users landlords could evict without cause, employers could take tips, and workers could be fired for reporting harassment. City left it live, adding a disclaimer. Misinformation | Public sector | Ongoing | The Markup |
| 2024-02 | Air Canada ordered to honor refund promised by chatbot Air Canada · Canada (British Columbia) BC Civil Resolution Tribunal ruled the airline liable for misinformation from its customer-service chatbot after it told a grieving passenger he could claim a bereavement refund retroactively. Airline had argued the chatbot was a "separate legal entity." Financial lossWrongful denial of service | Consumer / generative AI | Resolved | BBC News |
| 2024-02 | Arup — US$25M deepfake video-call fraud Arup Group · Hong Kong Finance worker wired HK$200M (~US$25.6M) after a video conference with deepfaked "CFO" and colleagues. Hong Kong police confirmed the incident. Widely used as a case study for deepfake fraud controls. Financial loss | Financial services | Ongoing | CNN Business |
| 2024-02 | Deepfake nude images generated of Idaho high-school students Unknown / classmates · US (Idaho) Male students generated deepfake nude images of female classmates using publicly available image-editing apps. Prompted multiple state deepfake criminalization bills. Now covered under Tennessee ELVIS Act analogs in 30+ states. ReputationalPrivacy breach | Education | Ongoing | Washington Post |
| 2023-12 | New York Times v. OpenAI, Microsoft — copyright infringement OpenAI, Microsoft · US (SDNY) NYT alleges training and output of GPT-4 reproduced substantial portions of copyrighted articles. Motions to dismiss largely denied in 2024. Discovery ongoing. IP infringement claim | Media / deepfakes | Ongoing | NYT complaint (PDF) |
| 2023-12 | Tesla Autopilot — NHTSA recall of 2M vehicles Tesla · US NHTSA recall covered ~2 million Tesla vehicles for insufficient driver-monitoring safeguards. Followup investigation opened in April 2024 about the sufficiency of the OTA fix. Physical harm | Transportation | Regulatory action | NHTSA recall |
| 2023-11 | UnitedHealth naviHealth (nH Predict) — Medicare Advantage denials UnitedHealth Group · US (D Minn) Class-action complaint alleges the nH Predict algorithm was used to override physician judgment and cut off post-acute care, with a documented ~90% override-on-appeal rate. Related to CMS 2024 clarification that AI cannot be sole basis for Medicare Advantage coverage decisions. Wrongful denial of serviceFinancial loss | Healthcare | Ongoing | STAT News investigation |
| 2023-06 | Mata v. Avianca — lawyer sanctioned for ChatGPT-fabricated cases Levidow, Levidow & Oberman · US (SDNY) Judge Castel imposed $5,000 sanctions on lawyers who cited six non-existent cases hallucinated by ChatGPT. Foundational precedent — cited by ABA and multiple state bars in AI-use guidance. MisinformationReputational | Legal | Resolved | SDNY opinion |
| 2023-05 | Samsung — engineers leaked source code via ChatGPT prompts Samsung · South Korea Semiconductor engineers pasted proprietary source code and meeting notes into ChatGPT to debug and summarize. Samsung banned employee GenAI use company-wide. Incident is a canonical DLP-for-AI failure. Privacy breachReputational | Consumer / generative AI | Resolved | Bloomberg |
| 2023-03 | Cigna PXDX — batch claim denials without physician review Cigna · US (ED Cal) ProPublica reported Cigna's PXDX algorithm denied thousands of claims in batches with an average physician review time of 1.2 seconds. California AG opened an investigation; multiple class actions filed. Wrongful denial of service | Healthcare | Ongoing | ProPublica investigation |
| 2023-03 | Garante temporary ban of ChatGPT in Italy OpenAI · Italy Italian DPA temporarily banned ChatGPT over Article 5 and Article 6 GDPR concerns. Service restored after OpenAI added age gate, transparency notice, and opt-out. Followed by €15M fine in Dec 2024. Privacy breach | Consumer / generative AI | Regulatory action | Garante action |
| 2023-01 | Getty Images v. Stability AI — image copyright and trademark Stability AI · UK / US (D Del) Getty alleges Stable Diffusion trained on 12M Getty images without a license, and that outputs sometimes reproduce the Getty watermark. UK High Court and US cases proceeding through 2025-2026. IP infringement claim | Media / deepfakes | Ongoing | Reuters |
| 2022-03 | Clearview AI — €20M fine by Italian data protection authority Clearview AI · Italy (Garante) Garante fined Clearview €20M and ordered deletion of Italian residents' biometric data. UK ICO followed with £7.5M in 2022; France (CNIL) issued €20M. Similar orders in Greece and Australia. Privacy breach | Consumer / generative AI | Regulatory action | Garante press release |
| 2021-06 | Kaiser Permanente — Epic sepsis alert overrides Epic Systems · US External validation study in JAMA Internal Medicine found the Epic Sepsis Model missed 67% of sepsis cases and generated frequent false alerts. Prompted a broader debate on regulatory oversight of clinical decision-support AI. Physical harm | Healthcare | Regulatory action | JAMA Internal Medicine |
| 2020-01 | Meta (Facebook) — $650M BIPA facial-recognition settlement Meta · US (Illinois) Meta paid $650 million to settle a class action under the Illinois Biometric Information Privacy Act (BIPA) over Tag Suggestions. Companion case with Texas AG later yielded $1.4B in 2024. Privacy breach | Consumer / generative AI | Settled | NPR |
| 2019-11 | Apple Card — gender-bias allegations in credit limits Goldman Sachs, Apple · US (NY DFS) NY DFS 2021 report concluded no unlawful discrimination but found "insufficient explainability" a systemic issue. Prompted state and federal focus on fair lending in ML models. Foundational case for state consumer-finance AI rules. Discrimination | Financial services | Regulatory action | NY DFS report |
| 2019-01 | Dutch childcare-benefits (toeslagenaffaire) — algorithmic profiling scandal Dutch Tax Authority · Netherlands Risk-scoring algorithm flagged dual-nationality families as fraud suspects; 26,000+ families wrongly forced to repay benefits, thousands driven into poverty. Cabinet resigned in January 2021. Foundational case for EU AI Act high-risk classification. DiscriminationFinancial lossWrongful denial of service | Public sector | Resolved | Amnesty International report |
| 2018-10 | Amazon internal recruiting AI showed gender bias Amazon · US Amazon scrapped an internal resume-screening AI after finding it penalized resumes containing "women's" (as in "women's chess club captain"). Referenced heavily in NYC LL-144 legislative history. Discrimination | Employment / HR | Resolved | Reuters |
| 2018-03 | Uber ATG — fatal autonomous-vehicle crash (Elaine Herzberg) Uber Advanced Technologies Group · US (Arizona) First recorded pedestrian fatality from a Level 4 autonomous vehicle. NTSB found inadequate safety culture, misconfigured object-classifier, disabled emergency braking. Safety driver pleaded guilty to negligent homicide (2023). Physical harm | Transportation | Resolved | NTSB report |
| 2016-05 | COMPAS — ProPublica racial-bias analysis Northpointe / Equivant · US (Wisconsin) ProPublica analysis found the COMPAS recidivism-risk tool assigned higher false-positive rates to Black defendants. Loomis v. Wisconsin (2016) upheld tool with cautions. Central case in bias-audit literature. Discrimination | Public sector | Resolved | ProPublica |
| 2016-03 | Microsoft Tay chatbot — offensive outputs within 24 hours Microsoft · US Twitter chatbot Tay produced racist, sexist content within 16 hours of launch after adversarial inputs. Microsoft shut it down. Referenced in many red-teaming curricula as canonical prompt-injection precedent. ReputationalMisinformation | Consumer / generative AI | Resolved | The Guardian |
By sector
Which industries are getting sued or investigated most
Healthcare
3- · UnitedHealth naviHealth (nH Predict) — Medicare Advantage denials
- · Cigna PXDX — batch claim denials without physician review
- · Kaiser Permanente — Epic sepsis alert overrides
Employment / HR
2- · Mobley v. Workday — AI hiring ADEA collective certified
- · Amazon internal recruiting AI showed gender bias
Financial services
2- · Apple Card — gender-bias allegations in credit limits
- · Arup — US$25M deepfake video-call fraud
Public sector
3- · Dutch childcare-benefits (toeslagenaffaire) — algorithmic profiling scandal
- · COMPAS — ProPublica racial-bias analysis
- · NYC MyCity chatbot advises businesses to break the law
Consumer / generative AI
8- · Air Canada ordered to honor refund promised by chatbot
- · Clearview AI — €20M fine by Italian data protection authority
- · Microsoft Tay chatbot — offensive outputs within 24 hours
- · Samsung — engineers leaked source code via ChatGPT prompts
Transportation
2- · Uber ATG — fatal autonomous-vehicle crash (Elaine Herzberg)
- · Tesla Autopilot — NHTSA recall of 2M vehicles
Media / deepfakes
2- · New York Times v. OpenAI, Microsoft — copyright infringement
- · Getty Images v. Stability AI — image copyright and trademark
Legal
1- · Mata v. Avianca — lawyer sanctioned for ChatGPT-fabricated cases
Education
1- · Deepfake nude images generated of Idaho high-school students
How to use
Why this matters for compliance buyers
- · Board-deck evidence. Reference specific incidents to justify AI compliance budget.
- · Article 73 reporting design. The EU AI Act requires providers to report serious incidents within 15 days (life-threatening: 2 days, widespread breach: 10 days). Model your reporting playbook on real cases here.
- · Vendor DDQ questions. Ask each AI vendor how they'd have prevented three specific incidents on this list.
- · Red-team scenario library. Every entry is a scenario your red team should be able to defend against.
Methodology. Incidents are included only if there is a primary source available (court filing, regulator action, or investigative journalism from a Tier-1 outlet). Contact us if you have a correction, addition, or update; we prioritize resolution and settlement updates as they become public.
Free vendor matchmaking
Worried about an AI incident at your company?
Get matched with AI governance vendors that ship incident response, model monitoring, and audit-ready evidence trails so your next deployment is not the next case study.
No credit card. Independent directory — we do not sell software ourselves.