Artificial Intelligence Policy Tracker
Legal requirement Incident reporting and handling European Union Partially applicable

Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office

Download: JSON · MarkdownUnder EU AI Act, Article 55(1)(c)

Verified against the official source 26 Sep 2026 (a factual check against the official source, not a legal review or legal advice)
What this label means
Verified
— a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review
— linked to the official source and in the queue for a reviewer to confirm.
Source-linked
— linked to the official source, not yet confirmed by a reviewer.
Verification policy and current standing · a factual check, not legal advice.
No change recorded as of 26 Sep 2026 · official source last checked
On this page 9 sections

In brief

Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office is a legal requirement under the EU AI Act in the European Union (Article 55(1)(c)). It applies from 2 August 2025. The record carries 2 evidence examples and mappings to 2 frameworks.

Instrument
EU AI Act
Jurisdiction
European Union
Nature
Legal requirement
Source reference
Article 55(1)(c)
Applies from
2 August 2025
Who it binds
General-purpose AI model provider
Evidence examples
2
Framework mappings
ISO/IEC 42001:2023, NIST AI Risk Management Framework 1.0
Controls that meet it
2
Official source
Open official text
Verification
Verified against the official source 26 Sep 2026

What does it require?

Providers of general-purpose AI models with systemic risk must keep track of, document and report without undue delay to the AI Office and, where relevant, to national competent authorities the relevant information about serious incidents and the possible corrective measures to address them. The General-Purpose AI Code of Practice sets out timelines and content that providers may follow to demonstrate compliance.

Practical action

Define serious-incident criteria for the model, a tracking log and an AI Office notification template with owner and clock.

Who does it apply to?

Providers of general-purpose AI models classified as having systemic risk under Article 51.

Applies from:

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

  • satisfiesProcessIncident coordinator · continuous
    AI incident management and regulatory reporting

    Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority

    Model-level incident criteria, log and AI Office reporting.

  • supportsPolicyHead of AI safety · annual
    Frontier model safety and security framework

    Serves 9 recorded duties · evidence: Published frontier safety framework, Dangerous-capability evaluation report, Threshold notification to an authority

    Framework defines the incident types and escalation.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

All 9 templates that cover it →

What evidence would a reviewer expect?

Evidence examples
EvidenceTypeNotes
Serious incident tracking log for the modelregister
AI Office incident notificationdocument

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Framework mappings table
FrameworkReferenceNoteConfidence
ISO/IEC 42001:2023Clause 10.2; Annex A.8.4Corrective action and incident communication.high
NIST AI RMF 1.0MANAGE 4.3, MEASURE 3.1Incident response and tracking of emergent risks.high

Frequently asked questions

Is this a legal requirement?

Yes. It is a legal requirement under EU AI Act (Article 55(1)(c)).

Who must comply with this obligation?

Providers of general-purpose AI models classified as having systemic risk under Article 51.

When does this obligation apply?

It applies from 2 August 2025.

What evidence shows compliance?

A reviewer would expect: Serious incident tracking log for the model; AI Office incident notification.

Which frameworks map to this obligation?

It is mapped to ISO/IEC 42001:2023 Clause 10.2; Annex A.8.4, NIST AI Risk Management Framework 1.0 MANAGE 4.3, MEASURE 3.1. These are editorial crosswalks with a stated confidence, not official mappings.

Which controls satisfy this obligation?

AI incident management and regulatory reporting; Frontier model safety and security framework.

What should an organisation do in practice?

Define serious-incident criteria for the model, a tracking log and an AI Office notification template with owner and clock.

Cite this record

AIPolicyTracker (2026). “Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office (EU AI Act)” [AIPT-OBL-0045, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0045 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0045: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

BibTeX
@misc{aipolicytracker2026_providersofsystemicriskg,
  author       = {{AIPolicyTracker}},
  title        = {{Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.

Similar obligations in other instruments

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.