Use this page to turn Articles 72 and 73 into a working high-risk AI monitoring and incident workflow.
Covers provider monitoring plans, deployer escalation, reporting clocks, corrective action, cooperation with authorities and notified bodies, and the separate GPAI systemic-risk route.
Structured answer sets in this page tree.
Cited legal and guidance references.
Articles 72 and 73 of the EU AI Act are high-risk AI system obligations. Article 72 requires providers to establish and document a proportionate post-market monitoring system based on a monitoring plan in the technical documentation. Article 73 requires providers of high-risk AI systems placed on the Union market to report serious incidents to the market surveillance authorities of the Member States where the incident occurred.
The provider's Article 72 system must actively and systematically collect, document, and analyse relevant data about high-risk AI system performance throughout the system lifetime. The data may come from deployers or other sources and must allow the provider to evaluate continuous compliance with the Chapter III, Section 2 high-risk requirements.
The monitoring plan is part of Annex IV technical documentation, so it should be versioned with the system description, intended purpose, risk management file, testing evidence, change history, instructions for use, and EU declaration of conformity. Treat deployer feedback, support tickets, operational logs, drift metrics, bias or discrimination signals, cybersecurity signals, near misses, and complaints as inputs to a monitored compliance file, not only as customer-success data.
Article 73 applies to providers of high-risk AI systems placed on the Union market. The provider reports any serious incident to the market surveillance authorities of the Member States where the incident occurred. The default outer limit is 15 days after the provider or, where applicable, the deployer becomes aware of the serious incident, but the report is due immediately after the provider establishes a causal link or reasonable likelihood of a causal link between the AI system and the incident.
The shorter clocks matter. A widespread infringement or a serious incident involving serious and irreversible disruption of critical infrastructure must be reported immediately and no later than two days after awareness. Death must be reported immediately after the provider or deployer establishes or suspects a causal relationship, and no later than 10 days after awareness. Where necessary for timely reporting, Article 73 allows an incomplete initial report followed by a complete report.
Article 20 sits next to Articles 72 and 73 in practice. If a provider considers, or has reason to consider, that a high-risk AI system it placed on the market or put into service is not in conformity, it must immediately take necessary corrective actions to bring it into conformity, withdraw it, disable it, or recall it as appropriate. It must also inform distributors and, where applicable, deployers, the authorised representative, and importers.
Where the system presents an Article 79 risk and the provider becomes aware of it, the provider must investigate causes, collaborating with the reporting deployer where applicable, and inform the competent market surveillance authorities and, where applicable, the notified body that issued a certificate. If the conformity route used Annex VII, notified-body touchpoints may also include approved quality-management changes, technical-documentation changes, certificate restrictions, or additional tests.
Article 26 makes deployers an early-warning source for provider monitoring and incident reporting. Deployers must monitor operation on the basis of the instructions for use and, where relevant, inform providers under Article 72. If they have reason to consider that use in accordance with instructions may result in Article 79 risk, they must without undue delay inform the provider or distributor and the relevant market surveillance authority, and suspend use.
If a deployer identifies a serious incident, it must immediately inform first the provider, then the importer or distributor and relevant market surveillance authorities. If the deployer cannot reach the provider, Article 73 applies mutatis mutandis. The contract, support process, and instructions for use should therefore give deployers a direct serious-incident route, not only a general support inbox.
The Commission's serious-incident template for general-purpose AI models with systemic risk is useful as a comparison point, but it is not the Article 73 route for high-risk AI systems. For GPAI models with systemic risk, Article 55(1)(c) requires providers to keep track of, document, and report relevant information about serious incidents and possible corrective measures to the AI Office and, as appropriate, national competent authorities.
A company can face both regimes when it provides a GPAI model and also places a high-risk AI system on the Union market, or when a high-risk AI system is built on a GPAI model. Keep the records connected but legally separated: Article 72 and 73 for the high-risk AI system and Article 55 for the GPAI model with systemic risk.
Create a system-specific monitoring plan in the technical documentation that defines data sources, deployer feedback routes, performance and risk signals, triage criteria, owners, records, and links back to risk management and corrective action.
It is urgent once the provider establishes a causal link or reasonable likelihood of a causal link between the high-risk AI system and a serious incident. The outer deadline is generally 15 days after awareness, but some incidents require reporting within two days or 10 days.
They should immediately inform the provider first, then the importer or distributor and relevant market surveillance authorities. If the provider cannot be reached, Article 73 applies mutatis mutandis.
Sorena can help map your high-risk AI systems, deployer channels, incident triage, corrective-action records, and authority reporting evidence against the cited AI Act sources.
Ask source-linked questions about Article 72 monitoring plans, Article 73 incident reporting, deployer escalation, and GPAI incident distinctions.
Review your post-market monitoring plan, serious-incident workflow, corrective-action records, and source gaps with Sorena.
"Patterns in post-market monitoring on serious incidents"
"general-purpose AI models with systemic risk"
"general-purpose AI models with systemic risk"