We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU AI Act

EU AI Act When must you report a serious incident?

High-risk system providers report serious incidents under Article 73. Report immediately when the causal-link test is met, with outer deadlines of 15, 10 or two days depending on the event.

Deployers have immediate escalation duties. General-purpose model providers with systemic risk follow a separate Article 55 reporting route.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
3 sections4 primary sources
Overview

Article 73 applies from 2 August 2026 to providers of high-risk AI systems placed on the EU market. First check the serious-incident outcomes in Article 3(49), your role and the causal-link test. Then select the recipient and deadline. The 2026 amendment, published on 24 July and in force from 27 July, sends reports for systems under the AI Office's exclusive competence to that Office.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

Which events must be reported, and by whom?

The provider normally reports to the market surveillance authorities where the occurred. If amended Article 75(1a) places the system under the AI Office's exclusive competence, report there instead. Article 3(49) covers incidents or malfunctions that directly or indirectly cause death or serious health harm; serious and irreversible disruption of critical infrastructure; infringement of EU-law duties protecting fundamental rights; or serious property or environmental harm.

Report immediately after establishing a causal link or a reasonable likelihood of one, subject to the outer deadline measured from awareness. Do not wait for a complete root-cause investigation. A malfunction without a listed serious outcome may still require monitoring, risk review or corrective action.

Article 73 has sector-specific reporting limits. For Annex III systems whose providers are already subject to equivalent Union reporting duties, the AI Act notification is limited to incidents involving infringement of Union-law obligations protecting fundamental rights. The same limit applies to high-risk AI that is, or is a safety component of, a medical device or in vitro diagnostic device under Regulations (EU) 2017/745 or 2017/746; that report goes to the national competent authority selected by the Member State where the incident occurred.

  • Confirm that the system is a high-risk AI system and that the event fits one of the Article 3 serious-incident outcomes.
  • Identify the Member State or Member States where the incident occurred because Article 73 points the report to those market surveillance authorities.
  • Record when the provider, or where applicable the deployer, became aware of the .
  • Record when the causal link or reasonable likelihood of a causal link was established, because that determines when the report must be made immediately.

Who reports a high-risk system incident?

The provider of the high-risk AI system owns the report. It normally reports to the market surveillance authorities of the Member States where the incident occurred. From 27 July 2026, amended Article 75(1a) requires a provider whose system falls under the AI Office's exclusive competence to report to the AI Office instead. A deployer that identifies a must immediately inform the provider first, then the importer or distributor and the relevant authority; if the provider cannot be reached, the deployer follows Article 73 with the necessary adjustments to its role, rather than waiting for contact to be restored.

Must causation be proven before reporting?

No. Article 73 triggers reporting immediately after the provider has established either a causal link between the AI system and the or the reasonable likelihood of such a link. For a death-related incident, the report is due immediately after the provider or deployer establishes, or as soon as it suspects, a causal relationship, subject to the Article 73 outer deadline.

Do equivalent sector rules remove all AI Act reports?

No. Article 73(9) limits AI Act reports for Annex III systems covered by equivalent Union reporting duties to incidents involving infringement of Union-law obligations protecting fundamental rights. Article 73(10) applies the same limited category to high-risk AI that is, or is a safety component of, a medical device or in vitro diagnostic device, with reporting to the Member State's selected national competent authority. The provider should document the equivalent regime and the specific Article 3(49)(c) screening result.

Question 2

What are the deadlines and follow-up steps?

The default outer deadline is 15 days from provider or, where applicable, deployer awareness. Report sooner: immediately after establishing a causal link or reasonable likelihood of one. For a or serious and irreversible critical-infrastructure disruption, report immediately and within two days of awareness. For death, report immediately after establishing or suspecting a causal relationship, within 10 days of awareness.

If needed for timely reporting, submit an incomplete initial report and follow it with a complete report. Investigate without delay, including risk assessment and corrective action. Cooperate with authorities and the notified body where relevant.

  • Keep separate timestamps for awareness, causal-link or reasonable-likelihood assessment, initial report, complete report, authority acknowledgements, and corrective actions.
  • Escalate critical-infrastructure disruption, widespread-infringement, and death-related cases into the shorter Article 73 timing track instead of using the default timing.
  • Do not alter the AI system in a way that may affect later evaluation of incident causes before informing competent authorities of that action.
  • Link the Article 73 report to the provider quality-management procedure for serious incidents and to the post-market monitoring evidence for the affected high-risk AI system.

Can we submit an incomplete initial report?

Yes. Article 73 allows an initial incomplete report when necessary to ensure timely reporting, followed by a complete report. The incomplete report should not be treated as closure; the provider still needs the investigation, risk assessment, corrective-action record, and authority cooperation required after reporting.

What corrective-action evidence should we keep?

The provider should preserve the incident facts, causal-link analysis, risk assessment, corrective actions, authority communications, notified-body communications where relevant, and any decision not to alter the AI system before notifying competent authorities. Article 20 also requires providers that consider or have reason to consider their high-risk AI system is non-conforming to take corrective actions such as bringing it into conformity, withdrawing it, disabling it, or recalling it as appropriate.

Question 3

What do deployers, suppliers and model providers do?

A deployer identifying a must immediately inform the provider first, then the importer or distributor and relevant authorities. Importers and distributors have separate duties to withhold, notify or help correct nonconforming or risky systems. Include their actions and notices in the incident record.

From 27 July 2026, the AI Office exclusively supervises specified systems based on a general-purpose model where the model and system share a provider or undertaking. Exclusions cover product-related systems, critical infrastructure, systems provided by law-enforcement or border-management authorities, financial-institution systems within Article 74(6), and justice systems.

The Office also supervises AI systems that constitute or are integrated into a designated very large online platform or search engine. Covered providers report to the AI Office, which passes relevant information to the national .

For a general-purpose model with systemic risk, use Article 55. The model provider must track, document and report relevant serious-incident information and possible corrective measures without undue delay to the AI Office and, as appropriate, national competent authorities. The Commission's model-incident template serves that duty. An Article 73 system report remains separate.

  • Check whether an importer, distributor, deployer, or other third party has become the provider by putting its name or trademark on the high-risk AI system, making a substantial modification, or changing intended purpose so the system becomes high-risk.
  • Use Article 23 importer records for provider, authorised-representative, and notice when the importer has sufficient reason to consider the high-risk AI system is non-conforming, falsified, or risky.
  • Use Article 24 distributor records for provider or importer notice, authority notice, and corrective-action handling when the distributor has sufficient reason to consider a high-risk AI system it made available is non-conforming or risky.
  • Check amended Article 75 before selecting the recipient. Record whether the system is under the AI Office's exclusive competence, which inclusion or exclusion applies, and whether the report went to the AI Office or the Member State authorities where the incident occurred.
  • Use a separate Article 55 record when the incident concerns a general-purpose AI model with systemic risk, including the model involved, resulting harm, chain of events, evidence of model involvement, response, root-cause analysis, and any corrective measures.

Do systemic-risk model incidents follow Article 73?

No. Article 73 is for providers of high-risk AI systems. Providers of general-purpose AI models with systemic risk have a separate Article 55 duty to keep track of, document, and report without undue delay to the AI Office and, as appropriate, national competent authorities relevant information about serious incidents and possible corrective measures.

Why involve importers and distributors?

They may not own the provider's Article 73 report, but Articles 23 and 24 require them to act on information that a high-risk AI system is non-conforming or presents a risk. Distributors may need to take or ensure corrective actions, and both importers and distributors may need to notify the provider, other operators, and competent authorities depending on their role and the facts.

When does the report go to the AI Office?

From 27 July 2026, amended Article 75(1a) routes the report to the AI Office when the AI Office has exclusive competence over the system under Article 75(1). This includes specified systems based on a general-purpose AI model where the model and system share a provider or undertaking, subject to the listed exclusions, and systems that constitute or are integrated into a designated very large online platform or very large online search engine. The provider should document the exact inclusion or exclusion instead of routing by product label alone.

Get help

Assign recipients, deadlines and follow-up

Sorena can help check incident intake, reporting clocks, deployer escalation, supplier notices and corrective-action records.

Research workflow
Research AI Act requirements

Check the legal sources and answers for your use case in Research Copilot.

Explore next step
Talk to Sorena
Review your implementation

Review your serious-incident intake workflow, evidence fields, and reporting responsibilities with Sorena.

Explore next step
Primary sources

References and citations

Regulation (EU) 2024/1689 (Artificial Intelligence Act)
eur-lex.europa.eu4 citations
Referenced sections
  • Primary legal text for the Article 3 serious-incident definition, Article 73 high-risk AI system reporting, Articles 20, 23, 24, 25 and 26 role duties, and Article 55 GPAI systemic-risk reporting.
  • Supports the Article 3 serious-incident definition, Article 26 deployer escalation, and Article 73 reporting duty for high-risk AI systems.
  • Supports Article 73 timing, incomplete initial reports, post-report investigations, risk assessment, corrective action, and Article 20 corrective-action options.
Show 1 more
  • Supports Article 23 importer duties, Article 24 distributor duties, Article 25 value-chain role changes, Article 26 deployer escalation, and Article 55 GPAI systemic-risk reporting.
"Reporting of serious incidents"
More quoted passages
"Providers of high-risk AI systems placed on the Union market shall report any serious incident"
"may submit an initial report that is incomplete, followed by a complete report"
"keep track of, document, and report, without undue delay"
European Commission - GPAI serious-incident reporting template
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission page for the serious-incident template used by providers of GPAI models with systemic risk under the Article 55 context.
  • Supports the distinction between Article 55 GPAI systemic-risk incident reporting and Article 73 high-risk AI system serious-incident reporting.
"Under Article 55 of the EU AI Act"
More quoted passages
"serious incidents involving general-purpose AI models with systemic risk"
European Commission - Guidelines for providers of general-purpose AI models
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission guidance page supporting the GPAI provider submission channel and the distinction between GPAI model-provider reports and Article 73 high-risk AI system reports.
  • Supports the AI Office submission context for GPAI model provider documents, including Article 55 serious-incident reports.
"Providers of general-purpose AI models must use the EU SEND platform"
More quoted passages
"Reports of serious incident pursuant to Art 55(1)(c)"
Regulation (EU) 2026/1744 (Digital Omnibus on AI)
eur-lex.europa.eu
Referenced sections
  • Binding amendment published on 24 July 2026, entering into force on 27 July 2026, which gives the AI Office exclusive supervision over specified AI systems and routes their Article 73 serious-incident reports to the AI Office.
"shall report any serious incidents to the AI Office"

Related guides

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

Show all related guides (34)

What must general-purpose model providers do? | EU AI Act

Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act penalties and fines

Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.

EU AI Act serious incident reporting steps

Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.