European UnionAI Act, Article 73 (reporting of serious incidents)
Regulation (EU) 2024/1689, Article 73
Amended by Regulation (EU) 2026/1744, which moved its start date from to for a high-risk AI system classified under Article 6(2) and Annex III.
An AI risk obligations rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Audit expectation
- none
What it requires
- For a high-risk AI system placed on the market or put into service, this duty takes effect on for a system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I; a system already on the market before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you test a high-risk AI system in real-world conditions outside an AI regulatory sandbox, report a serious incident identified in the course of the testing to the national market surveillance authority in accordance with this Article; Article 60(7) applies this from .
- If your high-risk AI system is placed on the EU market and you are its provider, report any serious incident to the market surveillance authority of the Member State where the incident occurred.
- Report a serious incident not later than 15 days after you become aware of it, or immediately once you establish a causal link between your AI system and the incident, or the reasonable likelihood of one, whichever is sooner.
- Report immediately, and not later than 2 days after becoming aware of it, a widespread infringement or a serious incident causing a serious and irreversible disruption to the management or operation of critical infrastructure.
- Report a serious incident involving the death of a person not later than 10 days after becoming aware of it, and immediately once you establish, or suspect, a causal link between your AI system and the incident.
- Where necessary for timely reporting, you may submit an initial report that is incomplete, followed by a complete report.
- If you are a deployer of a high-risk AI system and identify a serious incident, Article 26(5) requires you to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authority; if you cannot reach the provider, report the incident yourself under the same rules that bind a provider. This does not require you to disclose sensitive operational data if you are a law enforcement authority.
- After reporting a serious incident, without delay investigate it, including a risk assessment and corrective action, and cooperate with the competent authorities; do not alter the AI system in a way that could affect the investigation before telling the authorities.
- If your high-risk AI system is, or is a safety component of, a device covered by Regulation (EU) 2017/745 or (EU) 2017/746, report only an incident that infringes obligations under Union law intended to protect fundamental rights, and report it to the national competent authority the Member State chose for that purpose rather than to its market surveillance authority.
- If your high-risk AI system is within the AI Office's exclusive competence under Article 75(1), report the serious incident to the AI Office instead, on the same schedule. That covers an AI system based on a general-purpose AI model developed by you or by a provider in your undertaking, except an AI system related to a product covered by the Union harmonisation legislation listed in Annex I, one referred to in point 2 of Annex III, one provided by a law enforcement authority, a border management authority or a financial institution so far as Article 74(6) applies, and one referred to in point 8 of Annex III as regards the administration of justice; it also covers an AI system that constitutes or is integrated into a very large online platform or very large online search engine designated under Regulation (EU) 2022/2065.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Commission published its guidance on Article 73 as a draft, with a reporting template, for stakeholder consultation between and .
- As of
- Open questions
- Does the 15-day period in Article 73(2) run from the moment the provider 'becomes aware of the serious incident', or from the moment it has established a causal link or its reasonable likelihood, which Article 73(2) names first as the trigger for reporting 'immediately'?
- Which of the periods in Article 73(2), (3) and (4) governs a serious incident that is both the death of a person and a widespread infringement?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 73 requires a provider, or a deployer who cannot reach the provider, to report a serious incident within a deadline that runs from when it becomes aware of the incident, then to investigate the incident and cooperate with the competent authorities. The Article never uses the words logs, records, or audit trail, but meeting a deadline that runs from the moment of awareness, and investigating without altering the system before telling the authorities, cannot be done without keeping a contemporaneous account of what happened and when it was found.
- Kind
- Implicit
- As of
- Provision
- Article 73(1) to (6)
- Trigger
- high_risk_systems
- security_incident
Why the legislator wanted it
- As of
- Quote
- providers should also be required to have a system in place to report to the relevant authorities any serious incidents resulting from the use of their AI systems
- Source link
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Source kind
- Recital
- Purpose
- incident_reconstruction
- oversight_and_correction
- regulator_supervision
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Providers of high-risk AI systems placed on the EU market must report a serious incident to the market surveillance authority of the Member State where it occurred. The report is due immediately after the provider establishes a causal link between the AI system and the incident, or the reasonable likelihood of one, and in any event not later than 15 days after becoming aware of it.
For a widespread infringement or a serious incident causing a serious and irreversible disruption to critical infrastructure, the report is due immediately and not later than 2 days after becoming aware of it. Where the incident caused a person's death, the report is due immediately after the provider or deployer establishes, or suspects, a causal relationship, but not later than 10 days after becoming aware of it.
Where necessary for timely reporting, the provider, or deployer where applicable, may file an initial report that is incomplete, followed by a complete report. Under Article 26(5), a deployer who identifies a serious incident must immediately inform the provider first, then the importer or distributor and the market surveillance authority, and reports directly under the same rules if the provider cannot be reached.
That deployer duty does not cover sensitive operational data of a deployer that is a law enforcement authority. After reporting, the provider must without delay carry out the necessary investigations, including a risk assessment of the incident and corrective action, must cooperate with the competent authorities, and must not run any investigation that alters the AI system in a way that could affect a later evaluation of the causes before telling those authorities.
Where the provider of an Annex III high-risk system is already subject to Union instruments laying down equivalent reporting obligations, notification is limited to incidents that infringe obligations under Union law intended to protect fundamental rights.
Where the high-risk AI system is, or is a safety component of, a device covered by Regulation (EU) 2017/745 or (EU) 2017/746, notification is limited to that same class of incident and goes to the national competent authority the Member State where the incident occurred chose for that purpose, rather than to its market surveillance authority.
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) inserted a new Article 75(1a) requiring a provider of a high-risk AI system within the AI Office's exclusive supervisory competence to report a serious incident to the AI Office instead, with Article 73(2) to (9) applying in the same way.
That competence under Article 75(1) covers an AI system based on a general-purpose AI model where the model and the system are developed by the same provider or by providers forming part of the same undertaking, subject to listed exceptions, and an AI system that constitutes or is integrated into a very large online platform or very large online search engine designated under Regulation (EU) 2022/2065.
Article 73 sits in Chapter IX, which keeps the Regulation's general application date of , but its duty falls on providers of high-risk AI systems placed on the Union market, and the Digital Omnibus moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to for a system classified under Article 6(2) and Annex III and to for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, which means no provider of a system placed on the market or put into service owes a report under this Article before ; the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by .
Testing a high-risk AI system in real-world conditions outside an AI regulatory sandbox is not placing it on the market, and Article 60(7), in Chapter VI, which applies from , requires a serious incident identified in the course of that testing to be reported to the national market surveillance authority in accordance with Article 73.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .