EU AI Act
EU AI Act incident reporting: the two, ten and 15 day deadlines, and which one applies
The EU AI Act sets three deadlines for reporting serious incidents involving high-risk AI systems: 2 days, 10 days, and 15 days, all counted from the moment the provider or deployer becomes aware of the incident. The general rule also requires a report immediately once a causal link between the system and the incident, or the reasonable likelihood of one, is established. All three deadlines sit in Article 73, and the definitions that trigger them sit in Article 3(49).
What counts as a serious incident under the EU AI Act?
Article 3(49) defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to any of the following:
- (a) the death of a person, or serious harm to a person's health;
- (b) a serious and irreversible disruption of the management or operation of critical infrastructure;
- (c) the infringement of obligations under Union law intended to protect fundamental rights;
- (d) serious harm to property or the environment.
Two points in that definition matter for your process. The causal chain can be indirect. And a malfunctioning counts, not only a discrete incident. Note that limb (c) covers infringement of Union law obligations that protect fundamental rights, so an incident with no physical harm at all can still be reportable.
Critical infrastructure, for the purposes of limb (b), carries the definition in Article 2, point (4), of Directive (EU) 2022/2557.
Who must report a serious AI incident, and to whom?
Under Article 73(1), providers of high-risk AI systems placed on the Union market must report any serious incident to the market surveillance authorities of the Member States where the incident occurred. The reporting duty rests on the provider. The awareness clock, however, can start with either the provider or, where applicable, the deployer. Your process needs a channel that gets deployer awareness to the provider fast, because the statutory clock does not wait for that handoff.
What are the EU AI Act incident reporting deadlines?
| Outer deadline | Trigger | Provision |
|---|---|---|
| 2 days from awareness | A widespread infringement, or a serious incident under Article 3(49)(b): serious and irreversible disruption of the management or operation of critical infrastructure | Article 73(3) |
| 10 days from awareness | The death of a person | Article 73(4) |
| 15 days from awareness | Any other serious incident (the general rule) | Article 73(2) |
Widespread infringement is itself a defined term. Article 3(61) covers acts or omissions contrary to Union law protecting the interests of individuals that harm, or are likely to harm, collective interests across borders. One limb requires effects in at least two Member States other than specified home states. The other requires concurrent harm with common features, committed by the same operator, in at least three Member States.
Can you wait until the deadline to report an incident?
Every one of these periods is an outer limit on a duty to report immediately. Read Article 73(2):
The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident.
There are two clocks in that sentence. The 15-day clock runs from awareness of the incident. The immediate duty runs from establishing a causal link or its reasonable likelihood. If you establish the reasonable likelihood of a link on day 3, you report on day 3. You do not have 12 more days.
The second subparagraph of Article 73(2) adds that the reporting period shall take account of the severity of the serious incident. A severe incident compresses the time available even within the 15-day ceiling.
The death case in Article 73(4) sets an even lower bar for the immediate duty. The report must be made immediately after the provider or deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident. Suspicion triggers the duty. The 10-day period from awareness is only the backstop.
The 2-day rule in Article 73(3) requires the report immediately, and in any event not later than 2 days after the provider or deployer becomes aware of the incident.
Can you submit an incomplete report to meet the deadline?
Article 73(5) resolves the obvious tension between speed and accuracy:
Where necessary to ensure timely reporting, the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report.
Build this into your process as the default for short-deadline incidents. An initial report with gaps, filed inside the deadline, complies. A complete report filed after the deadline does not.
What must a provider do after reporting an incident?
Article 73(6) attaches an investigation duty to every report. After reporting, the provider must, without delay, perform the necessary investigations in relation to the serious incident and the AI system concerned. This must include a risk assessment of the incident, and corrective action.
There is a constraint that matters operationally. The provider must cooperate with the competent authorities, and where relevant the notified body. And before informing the competent authorities, the provider must not perform any investigation that involves altering the AI system in a way that may affect any subsequent evaluation of the causes of the incident. In practice, that means preserving the system state. Do not push a fix that destroys the evidence before the authorities know what you intend to do.
Which systems have narrower reporting duties, and what do authorities do?
Two carve-outs narrow the reporting duty. Under Article 73(9), providers of Annex III high-risk systems already subject to Union instruments with equivalent reporting obligations report only incidents under Article 3(49)(c), the fundamental rights limb. Under Article 73(10), high-risk systems that are safety components of devices, or are themselves devices, covered by Regulations (EU) 2017/745 and (EU) 2017/746 are likewise limited to Article 3(49)(c) incidents, reported to the national competent authority the Member State has chosen for that purpose.
On the receiving end, Article 73(7) requires the market surveillance authority, on a notification under Article 3(49)(c), to inform the national public authorities or bodies referred to in Article 77(1). The Commission must issue dedicated guidance on the paragraph 1 obligations by 2 August 2025 and assess it regularly. Under Article 73(8), the market surveillance authority must take appropriate measures under Article 19 of Regulation (EU) 2019/1020 within 7 days of receiving the notification. Under Article 73(11), national competent authorities must immediately notify the Commission of any serious incident, whether or not they have acted on it.
How do you work out which deadline applies to an incident?
You should be able to take a fact pattern, classify the harm against the four limbs of Article 3(49), and name the deadline that applies. You should be able to say when the clock started, whether the immediate duty has already been triggered by a causal link or a suspicion of one, and whether an incomplete initial report is the right move. You should also know what Article 73(6) forbids you to do to the system before informing the authorities. Get the trigger right first. The number follows from it.
Want it in one place? The EU AI Act compliance handbook works through EU AI Act compliance from the Official Journal text of Regulation (EU) 2024/1689, with every obligation traced to its Article, and the EU AI Act case studies book takes 24 situations a governance lead faces under the AI Act and works each one to a decision, settled against the Articles by number.
Frequently asked questions
How long do you have to report a serious AI incident in the EU?
Article 73(2) sets the general rule: immediately after establishing a causal link or its reasonable likelihood, and in any event not later than 15 days after becoming aware. Article 73(3) shortens it to two days for a widespread infringement or a serious incident as defined in Article 3, point (49)(b). Article 73(4) allows up to 10 days where a person has died.
Can you file an incomplete incident report?
Yes. Article 73(5) allows an initial incomplete report followed by a complete one where that is necessary to ensure timely reporting.
EU AI Act: test yourself in five minutes
Which books go deeper on this?
Building one that survives the EU AI Act. 22 chapters, 416 pages.
AI Governance Worked Scenarios
24 worked situations under the EU AI Act, decided against the Articles. 81 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
Every figure, date and quotation above was read from the document itself, not from a summary of it.
Credential Press is not affiliated with, endorsed by or authorized by the IAPP, ISO, the IEC or any other body. This is not legal advice.