EU AI Act serious incident reporting triage workflow

Open the triage only for an incident or malfunctioning of an AI system that directly or indirectly leads to one of the Article 3(49) harm categories. Near misses and ordinary support tickets may still matter for post-market monitoring, but Article 73 reporting turns on the serious-incident definition and the later causal-link assessment.

Record the affected system, deployment context, harm category, first awareness time, affected Member State, provider, deployer, importer or distributor contacts, available logs, and whether any evidence may be overwritten by normal operations.

For high-risk AI systems placed on the Union market, Article 73 makes the provider responsible for reporting any serious incident to the market surveillance authorities of the Member States where the incident occurred. The first routing decision is therefore: is this a high-risk AI system incident, and which Member State authority receives the report?

Do not wait for perfect root-cause certainty. The Article 73 clock runs after the provider establishes a causal link, or the reasonable likelihood of such a link, between the high-risk AI system and the serious incident. If timely reporting needs an incomplete initial report, Article 73 allows an initial incomplete report followed by a complete report.

Use one clock record for each incident. Record when the provider or deployer first became aware, when the causal link or reasonable likelihood was established, which accelerated category was considered, who approved the route, and when each authority received the initial and complete reports. If the incident occurred in more than one Member State, identify the market surveillance authority in each affected State rather than treating one filing as automatically sufficient everywhere.

Deployers of high-risk AI systems are not passive observers. Article 26 requires deployers to use the system according to the instructions for use, assign competent human oversight, monitor operation on the basis of those instructions, and act when risks or serious incidents appear.

The deployer escalation record should be short and operational: what was observed, when awareness started, who was informed, which instructions-for-use condition was involved, whether use was suspended, and whether the provider could be reached. If the deployer cannot reach the provider after identifying a serious incident, Article 73 applies mutatis mutandis.

Article 55 is a separate reporting lane for providers of general-purpose AI models with systemic risk. It is not the same as Article 73 high-risk AI system reporting to Member State market surveillance authorities.

For GPAI systemic-risk incidents, Article 55(1)(c) requires providers to keep track of, document, and report without undue delay to the AI Office and, as appropriate, national competent authorities, relevant information about serious incidents and possible corrective measures. The Commission's GPAI template asks for incident dates, harm, chain of events, model involved, evidence, response, recommendations, root-cause analysis, post-market monitoring patterns, and submitter information.