This page helps turn Articles 72 and 73 into a working high-risk AI monitoring and incident workflow.
Covers provider monitoring plans, deployer escalation, reporting clocks, corrective action, cooperation with authorities and notified bodies, and the separate GPAI systemic-risk route.
Structured answer sets in this page tree.
Cited legal and guidance references.
Articles 72 and 73 govern provider monitoring and serious-incident reporting for high-risk AI systems. Article 72 requires a proportionate, documented post-market monitoring system based on a plan in the technical documentation. Article 73 normally requires providers of high-risk systems placed on the Union market to report serious incidents to the market surveillance authority of the Member State where the incident occurred; amended Article 75 creates a separate AI Office recipient for specified systems under its exclusive supervision. The standard outside limit is 15 days after awareness, but specified widespread infringements and serious incidents affecting critical infrastructure have a two-day limit, and deaths have a 10-day limit. The report is due sooner once the required causal link or reasonable likelihood is established. Regulation (EU) 2026/1744 postpones Chapter III Sections 1-3 for high-risk systems, but it does not state that Articles 72 and 73 move to those new dates; keep the monitoring and reporting plan aligned to the application rule that governs the system and duty.
The provider's Article 72 system must actively and systematically collect, document, and analyse relevant data about high-risk AI system performance throughout the system lifetime. The data may come from deployers or other sources and must allow the provider to evaluate continuous compliance with the Chapter III, Section 2 high-risk requirements.
The monitoring plan is part of Annex IV technical documentation, so it should be versioned with the system description, intended purpose, risk management file, testing evidence, change history, instructions for use, and EU declaration of conformity. Treat deployer feedback, support tickets, operational logs, drift metrics, bias or discrimination signals, cybersecurity signals, near misses, and complaints as inputs to a monitored compliance file, not only as customer-success data.
Regulation (EU) 2026/1744 removes the power to impose one harmonised plan template. Instead, the Commission must publish guidance, including a voluntary post-market monitoring plan template, by 2 September 2027. Providers remain responsible for a plan that fits the system and organisation; waiting for the voluntary template does not replace system-specific preparation.
Article 73 applies to providers of high-risk AI systems placed on the Union market. The provider reports any to the market surveillance authorities of the Member States where the incident occurred. The default outer limit is 15 days after the provider or, where applicable, the deployer becomes aware of the serious incident, but the report is due immediately after the provider establishes a causal link or reasonable likelihood of a causal link between the AI system and the incident.
Regulation (EU) 2026/1744 creates a recipient exception for high-risk AI systems under the AI Office's exclusive competence in amended Article 75(1). Their providers report serious incidents to the AI Office instead; Article 73(2) to (9) applies with the necessary changes, and the AI Office promptly transmits the information to the market surveillance authority where the provider or its legal representative is situated. Check the Article 75 scope before choosing the recipient.
The shorter clocks matter. A widespread infringement or a involving serious and irreversible disruption of critical infrastructure must be reported immediately and no later than two days after awareness. Death must be reported immediately after the provider or deployer establishes or suspects a causal relationship, and no later than 10 days after awareness. Where necessary for timely reporting, Article 73 allows an incomplete initial report followed by a complete report.
Article 20 sits next to Articles 72 and 73 in practice. If a provider considers, or has reason to consider, that a high-risk AI system it placed on the market or put into service is not in conformity, it must immediately take necessary corrective actions to bring it into conformity, withdraw it, disable it, or recall it as appropriate. It must also inform distributors and, where applicable, deployers, the authorised representative, and importers.
Where the system presents an Article 79 risk and the provider becomes aware of it, the provider must investigate causes, collaborating with the reporting deployer where applicable, and inform the competent market surveillance authorities and, where applicable, the notified body that issued a certificate. If the conformity route used Annex VII, notified-body touchpoints may also include approved quality-management changes, technical-documentation changes, certificate restrictions, or additional tests.
Article 26 makes deployers an early-warning source for provider monitoring and incident reporting. Deployers must monitor operation on the basis of the instructions for use and, where relevant, inform providers under Article 72. If they have reason to consider that use in accordance with instructions may result in Article 79 risk, they must without undue delay inform the provider or distributor and the relevant market surveillance authority, and suspend use.
If a deployer identifies a , it must immediately inform first the provider, then the importer or distributor and relevant market surveillance authorities. If the deployer cannot reach the provider, Article 73 applies mutatis mutandis. The contract, support process, and instructions for use should therefore give deployers a direct serious-incident route, not only a general support inbox.
The Commission's serious-incident template for general-purpose AI models with systemic risk is useful as a comparison point, but it is not the Article 73 route for high-risk AI systems. For GPAI models with systemic risk, Article 55(1)(c) requires providers to keep track of, document, and report relevant information about serious incidents and possible corrective measures to the AI Office and, as appropriate, national competent authorities.
A company can face both regimes when it provides a GPAI model and also places a high-risk AI system on the Union market, or when a high-risk AI system is built on a GPAI model. Keep the records connected but legally separated: Article 72 and 73 for the high-risk AI system and Article 55 for the GPAI model with systemic risk.
Create a system-specific monitoring plan in the technical documentation that defines data sources, deployer feedback routes, performance and risk signals, triage criteria, owners, records, and links back to risk management and corrective action.
It is urgent once the provider establishes a causal link or reasonable likelihood of a causal link between the high-risk AI system and a . The outer deadline is generally 15 days after awareness, but some incidents require reporting within two days or 10 days.
They should immediately inform the provider first, then the importer or distributor and relevant market surveillance authorities. If the provider cannot be reached, Article 73 applies mutatis mutandis.
Sorena can help map your high-risk AI systems, deployer channels, incident triage, corrective-action records, and authority reporting evidence against the cited AI Act sources.
Ask questions tied to cited sources about Article 72 monitoring plans, Article 73 incident reporting, deployer escalation, and GPAI incident distinctions.
Review your post-market monitoring plan, serious-incident workflow, corrective-action records, and source gaps with Sorena.
"Patterns in post-market monitoring on serious incidents"
"general-purpose AI models with systemic risk"
"general-purpose AI models with systemic risk"