EU AI Act incident reporting: the two, ten and 15 day deadlines, and which one applies

The EU AI Act sets three deadlines for reporting serious incidents involving high-risk AI systems: 2 days, 10 days, and 15 days, all counted from the moment the provider or deployer becomes aware of the incident. The general rule also requires a report immediately once a causal link between the system and the incident, or the reasonable likelihood of one, is established. All three deadlines sit in Article 73, and the definitions that trigger them sit in Article 3(49).

First, what counts as a serious incident

Article 3(49) defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to any of the following:

• (a) the death of a person, or serious harm to a person's health;
• (b) a serious and irreversible disruption of the management or operation of critical infrastructure;
• (c) the infringement of obligations under Union law intended to protect fundamental rights;
• (d) serious harm to property or the environment.

Two points in that definition matter for your process. The causal chain can be indirect. And a malfunctioning counts, not only a discrete incident. Note that limb (c) covers infringement of Union law obligations that protect fundamental rights, so an incident with no physical harm at all can still be reportable.

Critical infrastructure, for the purposes of limb (b), carries the definition in Article 2, point (4), of Directive (EU) 2022/2557.

Who reports, and to whom

Under Article 73(1), providers of high-risk AI systems placed on the Union market must report any serious incident to the market surveillance authorities of the Member States where the incident occurred. The reporting duty rests on the provider. The awareness clock, however, can start with either the provider or, where applicable, the deployer. Your process needs a channel that gets deployer awareness to the provider fast, because the statutory clock does not wait for that handoff.

The three deadlines

Outer deadline	Trigger	Provision
2 days from awareness	A widespread infringement, or a serious incident under Article 3(49)(b): serious and irreversible disruption of the management or operation of critical infrastructure	Article 73(3)
10 days from awareness	The death of a person	Article 73(4)
15 days from awareness	Any other serious incident (the general rule)	Article 73(2)

Widespread infringement is itself a defined term. Article 3(61) covers acts or omissions contrary to Union law protecting the interests of individuals that harm, or are likely to harm, collective interests across borders. One limb requires effects in at least two Member States other than specified home states. The other requires concurrent harm with common features, committed by the same operator, in at least three Member States.

The deadlines are ceilings, not targets

Every one of these periods is an outer limit on a duty to report immediately. Read Article 73(2):

The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident.

There are two clocks in that sentence. The 15-day clock runs from awareness of the incident. The immediate duty runs from establishing a causal link or its reasonable likelihood. If you establish the reasonable likelihood of a link on day 3, you report on day 3. You do not have 12 more days.

The second subparagraph of Article 73(2) adds that the reporting period shall take account of the severity of the serious incident. A severe incident compresses the time available even within the 15-day ceiling.

The death case in Article 73(4) sets an even lower bar for the immediate duty. The report must be made immediately after the provider or deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident. Suspicion triggers the duty. The 10-day period from awareness is only the backstop.

The 2-day rule in Article 73(3) requires the report immediately, and in any event not later than 2 days after the provider or deployer becomes aware of the incident.

You can file incomplete, but you cannot file late

Article 73(5) resolves the obvious tension between speed and accuracy:

Where necessary to ensure timely reporting, the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report.

Build this into your process as the default for short-deadline incidents. An initial report with gaps, filed inside the deadline, complies. A complete report filed after the deadline does not.

The duty does not end when you file

Article 73(6) attaches an investigation duty to every report. After reporting, the provider must, without delay, perform the necessary investigations in relation to the serious incident and the AI system concerned. This must include a risk assessment of the incident, and corrective action.

There is a constraint that matters operationally. The provider must cooperate with the competent authorities, and where relevant the notified body. And before informing the competent authorities, the provider must not perform any investigation that involves altering the AI system in a way that may affect any subsequent evaluation of the causes of the incident. In practice, that means preserving the system state. Do not push a fix that destroys the evidence before the authorities know what you intend to do.

Narrower duties for some systems, and what the authority does next

Two carve-outs narrow the reporting duty. Under Article 73(9), providers of Annex III high-risk systems already subject to Union instruments with equivalent reporting obligations report only incidents under Article 3(49)(c), the fundamental rights limb. Under Article 73(10), high-risk systems that are safety components of devices, or are themselves devices, covered by Regulations (EU) 2017/745 and (EU) 2017/746 are likewise limited to Article 3(49)(c) incidents, reported to the national competent authority the Member State has chosen for that purpose.

On the receiving end, Article 73(7) requires the market surveillance authority, on a notification under Article 3(49)(c), to inform the national public authorities or bodies referred to in Article 77(1). The Commission must issue dedicated guidance on the paragraph 1 obligations by 2 August 2025 and assess it regularly. Under Article 73(8), the market surveillance authority must take appropriate measures under Article 19 of Regulation (EU) 2019/1020 within 7 days of receiving the notification. Under Article 73(11), national competent authorities must immediately notify the Commission of any serious incident, whether or not they have acted on it.

What you should be able to do with this

You should be able to take a fact pattern, classify the harm against the four limbs of Article 3(49), and name the deadline that applies. You should be able to say when the clock started, whether the immediate duty has already been triggered by a causal link or a suspicion of one, and whether an incomplete initial report is the right move. You should also know what Article 73(6) forbids you to do to the system before informing the authorities. Get the trigger right first. The number follows from it.