Serious incident reporting
Article 73 requires providers of high-risk AI to report serious incidents to the relevant market-surveillance authority, generally without undue delay and within set deadlines (as short as immediately, up to 15 days depending on severity).
A serious incident is defined in Article 3(49) as an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to a person's health, a serious and irreversible disruption of the management or operation of critical infrastructure, an infringement of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment. Reporting is to the market-surveillance authority of the member state where the incident occurred, immediately after the provider establishes a causal link or a reasonably likely one, and in any event no later than 15 days after becoming aware — shortened to 2 days for widespread infringement or critical-infrastructure disruption, and 10 days in the case of a death.
- Art. 3(49)
- Art. 73
- Art. 26(5)
Serious incident reporting: why it matters
The clock is the problem. Reporting deadlines run from awareness, not from the completion of an investigation, and the shortest of them is two days — which is far too short to build a notification process after the fact. Deployers are in the chain too: a deployer that identifies a serious incident must inform the provider without delay, so the process has to span two organisations that may be in different member states with different authorities.
Serious incident reporting in practice
A logistics company's route-optimisation system contributes to a warehouse accident causing serious injury. The deployer must notify the provider immediately. The provider investigates, establishes a reasonably likely causal link between the system's output and the harm, and reports to the market-surveillance authority of the member state where it happened — with an initial report inside the deadline even if the investigation is unfinished, followed by a complete report later.
Serious incident reporting: the mistake people make
Waiting until the root cause is confirmed before reporting. The trigger is establishing a causal link or a reasonably likely one, and the deadline runs from awareness of the incident — an initial incomplete report filed on time followed by a complete one is the expected pattern, not a late complete report.
Serious incident reporting: common questions
- What counts as a serious incident under the EU AI Act?
- Death or serious harm to a person's health, serious and irreversible disruption of critical infrastructure management or operation, infringement of Union law obligations protecting fundamental rights, or serious harm to property or the environment.
- How quickly must a serious incident be reported?
- Immediately after the causal link is established or reasonably likely, and no later than 15 days after awareness. That drops to 2 days for widespread infringement or serious critical-infrastructure disruption, and 10 days where a person has died.
- Do deployers have to report serious incidents?
- Deployers must inform the provider without delay when they identify a serious incident, and where the provider cannot be reached the deployer's own reporting obligations under Article 73 apply.
Serious incident reporting: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.