Article 73: reporting serious incidents
Two days is not enough time to build a reporting process. It is barely enough time to run one. Everything that makes this deadline achievable: the definition applied, the template pre-filled, the decision-maker named — has to exist before the incident.
What counts as a serious incident
Article 3 point 49 defines it as an incident or malfunctioning of an AI system that directly or indirectly leads to any of:
- the death of a person, or serious harm to a person’s health;
- a serious and irreversible disruption of the management or operation of critical infrastructure;
- infringement of obligations under Union law intended to protect fundamental rights;
- serious harm to property or the environment.
The third limb is the one that surprises people
An infringement of Union law protecting fundamental rights is a serious incident. No physical harm is required. A discriminatory outcome that breaches EU equality law is, on the face of the definition, reportable within 15 days, and the clock starts when you become aware, not when you finish investigating.
Expert analysis. How this limb is applied in practice is not yet settled and no enforcement decisions exist.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
The three clocks
| Deadline | Trigger | Basis |
|---|---|---|
| 2 days | A widespread infringement, or a serious incident as defined in Art. 3(49)(b) — serious and irreversible disruption of critical infrastructure | Art. 73(3): immediately, and not later than two days after becoming aware |
| 10 days | Death of a person | Art. 73(4): immediately after establishing, or as soon as suspecting, a causal relationship; not later than 10 days after becoming aware |
| 15 days | All other serious incidents | Art. 73(2): immediately after establishing a causal link or the reasonable likelihood of one; not later than 15 days after becoming aware |
The reporting period must take account of the severity of the incident: the outer limits above are ceilings, not entitlements. Reports go to the market surveillance authorities of the member state where the incident occurred, which for a multi-country deployment may be several.
Article 73(5): the incomplete initial report
Where necessary to ensure timely reporting, you may submit an initial report that is incomplete, followed by a complete report. For the two-day category this is usually the only realistic route. Knowing this in advance is the difference between reporting late and reporting partially.
What happens after you report
- Investigate without delay: Article 73(6) requires the necessary investigations in relation to the incident and the system, including a risk assessment of the incident and corrective action.
- Do not alter the system in a way that may affect any subsequent evaluation of the causes before informing the authorities. This cuts directly against the engineering instinct to hotfix.
- Expect a response within seven days. The market surveillance authority takes appropriate measures under Article 19 of Regulation (EU) 2019/1020 within seven days of the notification, measures which can include restrictions on making the product available, withdrawal or recall.
The freeze duty is an operational conflict you should resolve now
Your incident runbook probably says: mitigate immediately. Article 73(6) says do not alter the system in a way that affects evaluation of the causes before informing authorities. Both can be satisfied, take the system out of service, preserve state and logs, notify, then remediate, but only if the runbook says so before the incident. Practical recommendation.
Deployers are in the chain
A deployer that identifies a serious incident must immediately inform the provider, then the importer or distributor and the relevant market surveillance authority. Article 26(5) also requires a deployer with reason to consider that use in accordance with the instructions may present a risk to inform the provider and the authority without undue delay and to suspend use.
If you deploy other people’s AI, your contract should name who notifies whom and within what time, because your two-day clock and their fifteen-day clock are not the same clock.
Status labels on this page
Verified fact: The Art. 3(49) definition, the 15/10/2-day deadlines and their triggers, Art. 73(5) incomplete reports, the Art. 73(6) investigation and no-alteration duty, and the seven-day authority response under Reg. (EU) 2019/1020.
Expert analysis: The runbook conflict, the multi-country reporting observation, and the reading of the fundamental-rights limb.
Unsettled: How the fundamental-rights infringement limb will be applied. Commission guidance on Article 73 reporting has been consulted on; confirm the current published position.
Rehearse the two-day report
The single highest-value hour you can spend on Article 73 is a tabletop: an incident is reported at 4pm on a Friday, who decides it is serious, who drafts, who signs, which authority, and what gets preserved before anyone touches the system.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Questions
What is the EU AI Act serious incident reporting deadline?
Article 73 requires providers of high-risk AI systems to report serious incidents to the market surveillance authorities of the member state where the incident occurred, immediately after establishing a causal link or the reasonable likelihood of one, and in any event not later than 15 days after becoming aware. Two shorter deadlines apply: two days in the event of a widespread infringement or a serious incident as defined in Article 3 point 49(b), and 10 days in the event of the death of a person.
What counts as a serious incident under the EU AI Act?
Article 3 point 49 defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to a person's health, a serious and irreversible disruption of the management or operation of critical infrastructure, infringement of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment.
Can you file an incomplete incident report?
Yes. Article 73(5) provides that where necessary to ensure timely reporting, the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report. Given the two-day deadline for the most serious categories, an initial incomplete report is often the only realistic way to meet the timeline.
What must you do after reporting a serious incident?
Article 73(6) requires the provider, without delay, to perform the necessary investigations in relation to the serious incident and the AI system concerned, including a risk assessment of the incident and corrective action. The provider must not alter the AI system in a way that may affect any subsequent evaluation of the causes of the incident before informing the authorities. The market surveillance authority must take appropriate measures under Article 19 of Regulation (EU) 2019/1020 within seven days of receiving the notification.
Obligations, article by article
- Art. 5 prohibitions
- Art. 4 AI literacy
- Art. 50 transparency
- Art. 9 risk management
- Art. 10 data governance
- Art. 11 / Annex IV
- Arts. 12–13 logging
- Art. 14 human oversight
- Art. 15 accuracy & security
- Art. 17 QMS
- Arts. 43–48 conformity
- Art. 49 registration
- Art. 57 sandboxes
- Open source
- Art. 72 monitoring
- Arts. 51–56 GPAI
- Art. 99 penalties
- Compliance checklist
- FRIA template (Art. 27)
- When Annex III does not apply →