AI Act serious incidents Article 73 FAQ

For a high-risk AI system, Article 73 requires the provider to report any serious incident to the market surveillance authorities of the Member States where the incident occurred. Article 3, point (49), defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to death or serious harm to health, serious and irreversible disruption of critical infrastructure management or operation, infringement of Union-law obligations protecting fundamental rights, or serious harm to property or the environment.

The provider does not wait for perfect certainty about root cause. The Article 73 clock is tied to awareness of the serious incident and to establishing a causal link between the AI system and the incident, or a reasonable likelihood of that link.

Article 73 sets a default outer deadline of 15 days after the provider, or where applicable the deployer, becomes aware of the serious incident. Shorter outer deadlines apply for two categories: a widespread infringement or a serious and irreversible disruption of critical infrastructure management or operation must be reported not later than two days after awareness, and a death-related incident must be reported not later than 10 days after awareness.

If a complete report would delay timely reporting, Article 73 allows an incomplete initial report followed by a complete report. After reporting, the provider must without delay investigate the serious incident and the AI system concerned, including a risk assessment and corrective action, and must cooperate with competent authorities and, where relevant, the notified body.

A deployer is not the normal Article 73 reporter, but it has an explicit escalation duty when it identifies a serious incident: inform the provider first, then the importer or distributor and the relevant market surveillance authorities. Importers and distributors have their own high-risk AI system duties to withhold, notify, or help correct non-conforming or risky systems, so incident intake should route them into the communication record even when the provider owns the Article 73 report.

Do not merge this workflow with the EU AI Act rule for providers of general-purpose AI models with systemic risk. Article 55 requires those providers to keep track of, document, and report without undue delay to the AI Office and, as appropriate, national competent authorities relevant information about serious incidents and possible corrective measures. The Commission's GPAI serious-incident template is for that Article 55 model-provider context, not a replacement for Article 73 high-risk AI system reporting.