Report a serious incident involving a high-risk AI system to the market surveillance authority under AI Act Article 73

Documented steps

1. Test the event against the Article 3(49) definition of a serious incident: an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to a person's health; a serious and irreversible disruption of the management or operation of critical infrastructure; the infringement of obligations under Union law intended to protect fundamental rights; or serious harm to property or the environment. Text: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3
2. Confirm the reporting party. The provider of the high-risk AI system reports, and deployers have corresponding duties where they identify the incident. Text: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-73
3. Identify the addressee: the market surveillance authorities of the Member State where the incident occurred. This is national, not centralised at the AI Office, which differs from the GPAI systemic-risk incident track under Article 55.
4. Timestamp the moment of becoming aware. All three deadlines run from awareness, not from when the incident occurred, so the awareness timestamp is the single most important record.
5. Apply the standard deadline: report immediately after establishing the causal link, or the reasonable likelihood of one, and in any event not later than 15 days after becoming aware.
6. Apply the shortened deadline of not later than 2 days after becoming aware where the incident is a widespread infringement or involves a serious and irreversible disruption of the management or operation of critical infrastructure.
7. Apply the shortened deadline of not later than 10 days after becoming aware in the event of a person's death, running from the date the provider or deployer has established, or suspects, a causal relationship between the AI system and the incident.
8. Where full information is unavailable, submit an initial incomplete report within the deadline and follow it with a complete report. The deadline is not a reason to delay notification.
9. Investigate without delay: risk assessment of the incident, root cause analysis and corrective action, cooperating with the competent authority and the relevant notified body. Do not alter the system in a way that affects a subsequent evaluation of the causes before informing the authorities.
10. Expect the authority to act within 7 days of notification and to inform the Commission.
11. Build the runbook now, with named owners, the awareness log, the 2, 10 and 15 day clocks, and pre-drafted notification content, since these deadlines are too short to improvise.
12. Verify current addressee and any Omnibus amendments to Article 73 against the OJ text before finalising the runbook: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202601744