Who reports and to whom?

Providers of high-risk systems report serious incidents to market surveillance authorities (Art. 73). Whoever uses the system (deployer) must inform the provider (Art. 26) and, where relevant, the authority.

When do the AI Act incident obligations apply?

High-risk obligations for Annex III apply from 2 December 2027 after the Digital Omnibus. The GDPR applies today.

AI incidents: what to do, who to tell and within what deadlines

Q: What is a serious incident under the AI Act?

An incident or malfunction of an AI system that directly or indirectly leads to death or serious harm to health, serious disruption of critical infrastructure, an infringement of fundamental rights or serious harm to property or the environment (Article 3 definition).

Q: What if personal data is affected?

The GDPR requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33), unless the breach is unlikely to result in a risk.

Why prepare beforehand

It is like an evacuation plan: the day of the fire is not the time to decide who calls whom. An AI incident is often confusing at first (error, attack or misconfiguration?), and the first hours count.

A six-step procedure

Detect and record: anyone can report; note what, when and which system.
Contain: pause the affected system or function if needed (the stop button must exist beforehand).
Classify: does it affect people? Is personal data involved? Is it potentially serious?
Notify: the internal owner, the system provider and, if applicable, the authorities.
Fix: root cause and measures to prevent recurrence.
Document and learn: a short report and a review of the procedure.

Deadlines worth knowing

GDPR, personal data breach: notify the authority within 72 hours of becoming aware, if there is a risk (Art. 33).
AI Act, serious incident in a high-risk system: the provider reports to the authority (Art. 73); deadlines depend on severity and run from awareness. Check the text for your case.
Calendar: Annex III high-risk obligations apply from 2 December 2027 after the Digital Omnibus.

Common mistakes

Not knowing who decides to pause the system.
No provider contact for incidents.
No records to reconstruct what happened.

Frequently asked questions

What is a serious incident under the AI Act?

A failure of an AI system causing serious harm to people, critical infrastructure, fundamental rights, property or the environment.

What if personal data is affected?

The GDPR requires notifying the authority within 72 hours if there is a risk.

Informational content, not legal advice.

How will you monitor your systems after launch? Post-market monitoring: an editable template. €9.99. Support template, not legal advice.

View product