{"slug":"eu-ai-act-serious-incident-reporting","id":"AIPT-OBL-0021","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0021","title":"Report serious incidents to market surveillance authorities","short_title":"Reporting of serious incidents","category":"incident_handling","summary":"Providers of high-risk AI systems must report serious incidents to the market-surveillance authority of the Member State where the incident occurred, immediately after establishing a causal link (or reasonable likelihood) and no later than 15 days after becoming aware, with shorter limits for the most serious cases such as widespread infringements or death. Deployers must inform the provider and authorities when they identify a serious incident.\n","practical_action":"Add AI serious-incident criteria and time limits to your existing incident-response playbook.\n","is_binding":true,"applies_from":"2027-12-02","section":"Article 73","source_reference":"Article 73","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["biometrics","health","safety_critical"],"applicability":[{"description":"Providers and deployers of high-risk AI systems.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"AI incident response procedure","description":null,"artifact_type":"document"},{"title":"Incident log and authority notifications","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 10 Improvement; Annex A control on incident handling","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 4.3","note":"Incident response and communication.","confidence_level":"high","is_original":true}],"controls":[{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"satisfies","note":"Serious-incident criteria, causal-link decision and the reporting clock in the playbook.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"},{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"supports","note":"Logs support the investigation and report.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}