We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

WorkflowEU AI Act

EU AI Act serious incident reporting steps

Check the harm, preserve evidence and select the reporting deadline and recipient.

Use for high-risk AI systems and Article 55 for . One event may require both checks.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
4 sections8 primary sources
Overview

Start this check when a high-risk AI system placed on the EU market may have caused a . Notify the provider and record the first awareness time immediately. Reporting can be due sooner than the two-day, 10-day or 15-day outer limit; a final root-cause investigation can follow the initial report.

Section 1

1. Check whether the harm is a serious incident

Article 3(49) defines a by the outcomes below. Check whether the AI system's incident or malfunction directly or indirectly led to one of them. Near misses and routine faults can still need monitoring, safety, security or privacy action.

Record the system, context, harm, first awareness time and affected Member States. Add provider, deployer, importer and distributor contacts. Preserve logs and other evidence before normal operations overwrite them.

  • Article 3(49)(a): death of a person or serious harm to a person's health.
  • Article 3(49)(b): serious and irreversible disruption of the management or operation of critical infrastructure.
  • Article 3(49)(c): infringement of Union-law obligations intended to protect fundamental rights.
  • Article 3(49)(d): serious harm to property or the environment.
  • If none of these categories is plausible, close triage but keep the ordinary incident, post-market monitoring, security, privacy, or safety record.
Section 2

2. Select the recipient and deadline

The provider normally reports to the market surveillance authorities in every Member State where the incident occurred. For systems under the AI Office's exclusive supervision, amended Article 75(1a) makes the AI Office the recipient. Check Article 75(1) inclusions and exclusions before choosing the route.

Report immediately after establishing a causal link or a reasonable likelihood of one. The outer deadlines below run from awareness. Use an incomplete initial report followed by a complete report when needed to report on time.

Keep one timing record: provider or deployer awareness, causal-link finding, accelerated category, route approval, recipient and receipt times for initial and complete reports. An incident in several Member States may require several national recipients.

  • Default deadline: report immediately after the causal-link threshold is met and no later than 15 days after the provider or, where applicable, the deployer becomes aware of the .
  • Two-day acceleration: report immediately and no later than two days after awareness for a widespread infringement or an Article 3(49)(b) serious and irreversible disruption of critical infrastructure.
  • Death of a person: report immediately after the provider or deployer establishes or suspects a causal relationship, and no later than 10 days after awareness.
  • Medical-device overlap: for high-risk AI systems that are devices or safety components of devices covered by Regulations (EU) 2017/745 or 2017/746, (10) limits the AI Act notification to Article 3(49)(c) incidents and sends it to the national competent authority selected by the Member State where the incident occurred.
  • Equivalent-reporting overlap: for Annex III systems whose providers are subject to equivalent Union-law reporting obligations, (9) limits AI Act notification to Article 3(49)(c) fundamental-rights incidents. Identify the equivalent reporting law and continue the required sectoral reports.
  • After reporting, the provider must investigate without delay, perform incident risk assessment, take corrective action, cooperate with competent authorities and any relevant notified body, and avoid altering the AI system in a way that could affect later causal evaluation before informing authorities.
  • Authority follow-up: requires the receiving market surveillance authority to take appropriate measures within seven days after receiving the notification. Keep acknowledgement, questions, requested measures, responses, and closure evidence with the report.
  • Do not treat the Commission consultation package as final law or a mandatory final form. It contains draft high-risk incident guidance and a draft reporting template. Follow and the receiving market surveillance authority's current filing instructions, and preserve a copy of what was submitted, when, by whom, and through which channel.
Section 3

3. Escalate from the organisation using the system

Article 26 requires deployers to follow the instructions for use, assign competent human oversight and monitor operation. They must act when a risk or appears.

Record what was observed, when awareness began, who was informed, the relevant instruction, any suspension and attempts to contact the provider. If the provider cannot be reached after a is identified, applies to the deployer with the necessary changes.

  • If use according to the instructions may cause the system to present a risk, the deployer informs the provider or distributor and the relevant market surveillance authority without undue delay, and suspends use.
  • If the deployer identifies a , it immediately informs first the provider, then the importer or distributor and the relevant market surveillance authorities.
  • Keep logs under deployer control for an appropriate period for the intended purpose and at least six months unless other Union or national law provides otherwise.
  • For the handover, collect incident time, system version, use case, input data context, outputs, human-oversight notes, user impact, authority contact attempts, suspension decision, and preservation steps.
  • Exclude sensitive operational data of law-enforcement deployers where Article 26 preserves that limitation.
Section 4

4. Check GPAI model-provider reporting

Article 55 covers providers of . Keep this model-level check separate from system reporting, even when both reports go to the AI Office.

Under Article 55(1)(c), the provider must track, document and report relevant serious-incident information and possible corrective measures without undue delay to the AI Office and, as appropriate, national competent authorities.

The Commission's GPAI template asks for dates, harm, events, model, evidence, response, recommendations, root-cause analysis, monitoring patterns and submitter details. Use the relevant route's instructions and record the filing.

  • Use when the fact pattern is a involving a high-risk AI system placed on the Union market.
  • Use Article 55 when the fact pattern concerns a provider of a general-purpose AI model with systemic risk reporting serious-incident information and possible corrective measures.
  • If a GPAI model is embedded in a high-risk AI system, run both checks: downstream high-risk AI system reporting may sit with the high-risk-system provider, while systemic-risk model reporting may sit with the GPAI model provider.
  • Keep separate records for authority reporting, Article 26 deployer escalation, and Article 55 GPAI systemic-risk reporting so deadlines, recipients, and evidence fields do not get mixed.
  • For GPAI, include model-level evidence such as outputs, inputs, mitigation failures or circumventions, post-market monitoring patterns, and near-miss patterns where reasonably connected to the .
Next step

Set contacts, clocks and evidence fields

Sorena can help set up incident intake, deployer escalation, authority reporting and corrective-action records.

Research workflow
Ask Research Copilot

Ask which reporting deadline, recipient or model-level duty applies to an incident.

Explore next step
Talk to Sorena
Discuss your implementation

Review reporting steps, contacts and evidence needed for your systems and models.

Explore next step
Primary sources

References and citations

Regulation (EU) 2024/1689 (EU AI Act)
eur-lex.europa.eu5 citations
Referenced sections
  • Primary legal text for Article 3(49), Article 26 deployer escalation, Article 55 GPAI systemic-risk reporting, and Article 73 high-risk AI serious-incident reporting.
  • Article 3(49) defines the serious-incident harm categories used as the first triage gate.
  • Article 73 sets the recipient authority, causal-link trigger, 15-day, two-day, and 10-day reporting clocks, incomplete-report option, and investigation/corrective-action duties.
Show 2 more
  • Article 26 supports deployer monitoring, escalation, suspension, immediate serious-incident notice, log retention, and cooperation points for high-risk AI systems.
  • Article 55(1)(c) creates the GPAI systemic-risk provider duty to track, document, and report serious-incident information and possible corrective measures.
"Reporting of serious incidents"
More quoted passages
"serious incident"
"Obligations of deployers of high-risk AI systems"
"Obligations of providers of general-purpose AI models with systemic risk"
European Commission - AI Act serious AI incidents consultation
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission consultation page referenced in the cited source material for draft guidance and a reporting template on serious AI incidents involving high-risk AI systems.
"serious AI incidents"
More quoted passages
"reporting template on serious AI incidents"
European Commission - GPAI serious-incident report template
ec.europa.eu2 citations
Referenced sections
  • Official GPAI report template fields for Article 55 serious-incident reports, including harm, events, model involvement, evidence, response, root cause, and monitoring patterns.
  • The official GPAI template lists the practical fields for Article 55 serious-incident reports, including harm, chain of events, model involved, evidence, response, root cause, and post-market monitoring patterns.
"Report for Serious Incidents"
More quoted passages
"Reporting Template"
European Commission - GPAI serious-incident reporting template
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission page for the Article 55 serious-incident template for general-purpose AI models with systemic risk.
  • Commission page confirms the template is for serious incidents involving general-purpose AI models with systemic risk under Article 55.
"general-purpose AI models with systemic risk"
European Commission - Guidelines for GPAI providers
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission guidance page for the scope and submission context of obligations applying to providers of general-purpose AI models.
  • Commission guidance page clarifies the scope of obligations for providers of general-purpose AI models and links those obligations to AI Office submissions.
"general-purpose AI models"
More quoted passages
"providers of general-purpose AI models"
European Commission - Navigating the AI Act
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission FAQ context for high-risk provider and deployer obligations, including monitoring, serious-incident response, corrective actions, and GPAI systemic-risk duties.
  • Commission FAQ explains that deployers monitor high-risk AI systems, act on identified risks or serious incidents, and assign human oversight.
"reporting serious incidents"
More quoted passages
"monitor the operation"
Regulation (EU) 2026/1744
eur-lex.europa.eu
Referenced sections
  • Amends Article 75 to assign specified AI systems to the AI Office and route their Article 73 serious-incident reports to that Office.

Related guides

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act penalties and fines

Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.

Show all related guides (34)

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

What must general-purpose model providers do? | EU AI Act

Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.