# What is serious incident reporting under the EU AI Act?

> Serious incident reporting is the EU AI Act duty to tell a regulator, fast, when a high-risk system causes real harm or a rights breach.

Source: https://meshin.co/glossary/serious-incident-reporting
Updated: 2026-10-02

---

## Why it comes up

It surprises companies who assume that deploying a high-risk system is a one-time compliance exercise. That is the same surprise a data-breach notification law gives a company that has never had to report one before. A board's real question is usually simpler. If something goes badly wrong, does the company already know who calls the regulator? The alternative is a decision made live, under pressure, by whoever happens to be in the room.

## What to do about it

Decide in advance, in writing, who has the authority to judge that an incident is serious enough to report. Avoid leaving that call to whoever notices the problem first. Preserve the system's state at the time of the incident for investigation, instead of immediately patching it away. The [Fractional CAIO Retainer](/services/fractional-caio-retainer) makes me the named point of contact for this kind of question, answered before it is urgent.