Monitor high-risk AI after release and act quickly when a occurs.
Providers run monitoring and reporting. Deployers supply feedback, escalate risks and suspend unsafe use where required.
Providers of high-risk AI systems need a documented post-market monitoring plan under Article 72 and a reporting process under Article 73. Record awareness immediately: outer reporting limits are normally 15 days, two days for specified widespread infringements or critical-infrastructure incidents, and 10 days for deaths. Earlier reporting triggers still apply. Check the recipient and exceptions below.
Under Article 72, the provider must actively collect, document and analyse relevant performance data throughout the system's lifetime. Use deployer feedback and other sources to check continuing compliance with the high-risk requirements in Chapter III Section 2.
Keep the plan in the Annex IV technical documentation. Version it with the intended purpose, system description, risk file, tests, changes, instructions and EU declaration of conformity. Include feedback, support tickets, logs, performance drift, bias signals, security events, near misses and complaints.
Regulation (EU) 2026/1744 replaced the power to impose one harmonised plan template with Commission guidance and a voluntary template due by 2 September 2027. Prepare a system-specific plan while that work continues.
Sources (2)
Article 72 requires a documented post-market monitoring system and plan for high-risk AI systems; Annex IV requires the technical documentation to describe that plan and the post-market performance evaluation system.
actively and systematically collect, document and analyse relevant data
Supports the limited postponement of Chapter III Sections 1-3 and the Article 72 change to Commission guidance with a voluntary template by 2 September 2027.
The provider normally reports to the market surveillance authority, the body supervising product compliance, in each Member State where the incident occurred. Report immediately after establishing a causal link or a reasonable likelihood of one. The normal outer limit is 15 days after the provider or, where applicable, deployer becomes aware.
A or serious and irreversible disruption of critical infrastructure requires immediate reporting, no later than two days after awareness. A death requires reporting immediately after the provider or deployer establishes or suspects a causal relationship, no later than 10 days after awareness. Send an incomplete initial report followed by a complete report if necessary to meet the deadline.
Check whether amended Article 75 assigns the system to the AI Office's exclusive supervision. If so, the provider reports to the AI Office instead; Article 73(2)-(9) applies with the necessary changes. The AI Office promptly sends the information to the market surveillance authority where the provider or legal representative is situated.
Article 75(1) covers systems based on GPAI models when the model and system providers are the same provider or part of the same undertaking. It excludes Annex I products, Annex III point 2 infrastructure, specified Article 74(6) sector-supervised systems and Annex III point 8 justice systems. It also covers systems constituting or integrated into designated very large online platforms or search engines. Record the applicable route and exclusions.
Check sector overlap under Article 73(9)-(10). For Annex III providers subject to equivalent Union-law reporting duties, AI Act notification is limited to incidents infringing Union-law fundamental-rights obligations. The same limit applies to devices or safety components under the Medical Devices and In Vitro Diagnostic Medical Devices Regulations, (EU) 2017/745 and 2017/746. Those reports go to the national competent authority chosen by the Member State where the incident occurred. Continue applicable sectoral reports.
Sources (2)
Article 3(49) defines serious incidents; Article 73 sets the recipients, timing, incomplete-report option, investigation duty, and authority cooperation duty.
report any serious incident to the market surveillance authorities
Supports the AI Office reporting recipient for serious incidents involving high-risk systems under its exclusive competence and the onward transmission rule.
Article 20 requires providers who consider, or have reason to consider, their high-risk system non-compliant to act immediately. Correct it, withdraw it, disable it or recall it as appropriate. Inform distributors and, where applicable, deployers, the authorised representative and importers.
If the system presents an Article 79 risk to health, safety or fundamental rights, investigate the causes with the reporting deployer where relevant. Inform competent market surveillance authorities and any notified body that issued a certificate. A notified body is an authorised conformity-assessment organisation.
For an Annex VII assessment, also check whether approved quality-management procedures, technical documentation, certificate restrictions or further tests need attention. Keep those decisions with the incident record.
Sources (2)
Article 20 requires immediate corrective action and information duties for non-conforming high-risk AI systems; Annex VII covers notified-body assessment, surveillance, and changes that can affect compliance.
immediately take the necessary corrective actions
Article 1 and the Annex cite EN 18286:2026. Article 2 and recital 6 establish effect from publication on 14 October 2026, limited to requirements covered by the standard.
Deployers are organisations using an AI system under their authority. Article 26 requires them to monitor operation against the instructions for use and, where relevant, inform the provider under Article 72.
If instructed use may create an Article 79 risk, the deployer must notify the provider or distributor and relevant market surveillance authority without undue delay, and suspend use. For a , it must immediately inform the provider first, then the importer or distributor and relevant authorities.
If the deployer cannot reach the provider, Article 73 applies with the necessary changes to the deployer's situation. Put a direct incident contact in the contract, support process and instructions so escalation can happen promptly.
Sources (1)
Article 26(5) requires deployers to monitor high-risk AI operation, inform providers, suspend risky use, and escalate serious incidents; Article 26(6) requires them to retain generated logs under their control for at least six months unless another law provides otherwise.
Deployers shall monitor the operation of the high-risk AI system
Article 55(1)(c) applies to providers of GPAI models with systemic risk. They must track, document and report relevant serious-incident information and possible corrective measures without undue delay to the AI Office and, as appropriate, national competent authorities. The Commission's model-incident template supports this route.
One event may require both model and system checks. A company can provide a GPAI model and a high-risk system, or a high-risk system can use another provider's model. Share the factual chronology, then record each actor's reporting duty, recipient and deadline separately.
The high-risk deferral in Regulation (EU) 2026/1744 covers Chapter III Sections 1-3. It does not state that Articles 72 and 73 move to those dates. Check the application and transition rule for the specific system and duty before scheduling monitoring and reporting work.
Create a plan for each high-risk system and keep it in the technical documentation. Name the data sources, deployer-feedback channels, performance and risk signals, decision criteria, owners and records. Connect findings to risk management and corrective action.
Report immediately after establishing a causal link or a reasonable likelihood of one. The normal outer limit is 15 days after awareness. Widespread infringements and specified critical-infrastructure incidents have a two-day limit. Deaths require reporting immediately on an established or suspected causal relationship, within 10 days of awareness.
Immediately inform the provider first, then the importer or distributor and relevant market surveillance authorities. If the provider cannot be reached, Article 73 applies to the deployer with the necessary changes.
Sources (3)
Article 55(1)(c) creates the separate serious-incident and corrective-measure duty for GPAI models with systemic risk.
general-purpose AI models with systemic risk
Commission page explaining that the GPAI serious-incident template concerns general-purpose AI models with systemic risk under Article 55.
general-purpose AI models with systemic risk
Commission GPAI report form listing fields such as harm, chain of events, evidence, response, root cause analysis, monitoring patterns, and submitter information.
Patterns in post-market monitoring on serious incidents
Sorena can help define monitoring inputs, incident escalation, corrective actions and reporting records for your high-risk AI systems.
"POST-MARKET MONITORING, INFORMATION SHARING AND MARKET SURVEILLANCE"
"actively and systematically collect, document and analyse relevant data"
"report any serious incident to the market surveillance authorities"
"immediately take the necessary corrective actions"
"Deployers shall monitor the operation of the high-risk AI system"
"general-purpose AI models with systemic risk"
"Report for Serious Incidents under the AI Act"
"Patterns in post-market monitoring on serious incidents"
"Under Article 55 of the EU AI Act"
"general-purpose AI models with systemic risk"
Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.