Serious incident reporting
What it means
What is serious incident reporting under the EU AI Act?
Serious incident reporting is the EU AI Act duty to notify the relevant national authority after a high-risk AI system causes serious harm. It falls on the provider, the company that built the system, and sometimes the deployer, the company running it. The default deadline is fifteen days from awareness.
The duty applies once a malfunction leads to death, serious harm, or a serious breach of someone's fundamental rights.
Article 73 sets the default deadline at fifteen days from when the provider becomes aware of the incident. A widespread infringement or a serious disruption to critical infrastructure tightens that to two days. A death tightens it further, to ten days. Every deadline runs from awareness, not from the incident itself.
Once the provider files the report, it has to investigate: assess the risk, take corrective action, and cooperate with the authority. It cannot alter the system in a way that would affect the investigation's findings without telling the authority first. The duty also covers serious harm to property or the environment, not only harm to people, though that case still runs on the fifteen-day default.
Published · Updated
In practice
Why it comes up
It surprises companies who assume that deploying a high-risk system is a one-time compliance exercise. That is the same surprise a data-breach notification law gives a company that has never had to report one before. A board’s real question is usually simpler. If something goes badly wrong, does the company already know who calls the regulator? The alternative is a decision made live, under pressure, by whoever happens to be in the room.
What to do about it
Decide in advance, in writing, who has the authority to judge that an incident is serious enough to report. Avoid leaving that call to whoever notices the problem first. Preserve the system’s state at the time of the incident for investigation, instead of immediately patching it away. The Fractional CAIO Retainer makes me the named point of contact for this kind of question, answered before it is urgent.