AI Act serious incidents Article 73 FAQ

For a high-risk AI system, Article 73 normally requires the provider to report any serious incident to the market surveillance authorities of the Member States where the incident occurred. From 27 July 2026, amended Article 75(1a) instead sends reports to the AI Office when the system falls under the AI Office's exclusive supervision. Article 3, point (49), defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to death or serious harm to health, serious and irreversible disruption of critical infrastructure management or operation, infringement of Union-law obligations protecting fundamental rights, or serious harm to property or the environment.

The provider does not wait for perfect certainty about root cause. The Article 73 clock is tied to awareness of the serious incident and to establishing a causal link between the AI system and the incident, or a reasonable likelihood of that link. A malfunction without one of the Article 3(49) outcomes is not a serious incident under this definition, although it may still trigger monitoring, risk, non-conformity, or corrective-action duties.

Article 73 has sector-specific reporting limits. For Annex III systems whose providers are already subject to equivalent Union reporting duties, the AI Act notification is limited to incidents involving infringement of Union-law obligations protecting fundamental rights. The same limit applies to high-risk AI that is, or is a safety component of, a medical device or in vitro diagnostic device under Regulations (EU) 2017/745 or 2017/746; that report goes to the national competent authority selected by the Member State where the incident occurred.

Article 73 requires reporting immediately after the provider establishes a causal link or reasonable likelihood of a link and sets a default outer deadline of 15 days after the provider, or where applicable the deployer, becomes aware of the serious incident. Shorter outer deadlines apply for two categories: a widespread infringement or a serious and irreversible disruption of critical infrastructure management or operation must be reported immediately and no later than two days after awareness, and a death-related incident must be reported immediately after a causal relationship is established or suspected and no later than 10 days after awareness.

If a complete report would delay timely reporting, Article 73 allows an incomplete initial report followed by a complete report. After reporting, the provider must without delay investigate the serious incident and the AI system concerned, including a risk assessment and corrective action, and must cooperate with competent authorities and, where relevant, the notified body.

A deployer is not the normal Article 73 reporter, but it has an explicit escalation duty when it identifies a serious incident: inform the provider first, then the importer or distributor and the relevant market surveillance authorities. Importers and distributors have their own high-risk AI system duties to withhold, notify, or help correct non-conforming or risky systems, so incident intake should route them into the communication record even when the provider owns the Article 73 report.

From 27 July 2026, the AI Office has exclusive supervision over specified AI systems. The covered set includes certain systems based on a general-purpose AI model where the model and system share the same provider or undertaking, subject to the listed exclusions for product-related systems, critical infrastructure, systems provided by law-enforcement or border-management authorities, financial-institution systems within Article 74(6), and justice systems, plus systems that constitute or are integrated into a designated very large online platform or very large online search engine. Providers in that set report Article 73 incidents to the AI Office, which transmits the relevant information to the national market surveillance authority.

Do not merge this system-level route with the EU AI Act rule for providers of general-purpose AI models with systemic risk. Article 55 requires those model providers to keep track of, document, and report without undue delay to the AI Office and, as appropriate, national competent authorities relevant information about serious incidents and possible corrective measures. The Commission's GPAI serious-incident template is for that Article 55 model-provider context, not a replacement for an Article 73 high-risk AI system report.