Serious incident reporting under Article 73: what the provider logs before the report
Category Enforcement
Published AIAssuranceLabs
Art. 73(1) of Regulation (EU) 2024/1689 requires the provider of a high-risk AI system placed on the Union market to report any serious incident, as defined in Art. 3(49), to the market surveillance authority of the Member State where the incident occurred. Art. 73(2) to 73(4) set the reporting periods by tier. The Chapter III duties the report draws on, the Art. 12 logs and the Art. 9 risk management file, apply from the Annex III date in the regulation data Deferred.
What the source says
Art. 3(49) defines a serious incident as an incident or malfunctioning of an AI system that directly or indirectly leads to one of four results: (a) the death of a person, or serious harm to a person's health; (b) a serious and irreversible disruption of the management or operation of critical infrastructure; (c) the infringement of obligations under Union law intended to protect fundamental rights; (d) serious harm to property or the environment. The definition turns on the causal chain from the system to the result, and the reporting periods in Art. 73(2) to 73(4) run from the causal-link finding, or its suspicion under Art. 73(4), and in any event from awareness of the incident.
Art. 73(1) places the reporting duty on the provider. Art. 73(2) sets the default period: the report is made immediately after the provider has established a causal link between the AI system and the serious incident, or the reasonable likelihood of such a link, and in any event not later than 15 days after the provider or, where applicable, the deployer becomes aware of the incident. Art. 73(3) and 73(4) shorten the period for two tiers, and Art. 73(5) allows an initial incomplete report where necessary for timely reporting.
| Trigger | Paragraph | Period stated in the Act |
|---|---|---|
| Any serious incident under Art. 3(49) | Art. 73(2) | Immediately after the causal link or its reasonable likelihood is established; in any event not later than 15 days after awareness; the period takes account of severity |
| A widespread infringement, or a serious incident under Art. 3(49)(b) | Art. 73(3) | Immediately, and not later than two days after awareness |
| The death of a person | Art. 73(4) | Immediately after a causal relationship is established or suspected; not later than 10 days after awareness |
| Report cannot be complete in time | Art. 73(5) | An initial incomplete report, followed by a complete report |
| Authority action after receipt | Art. 73(8) | Measures under Art. 19 of Regulation (EU) 2019/1020 within seven days from the date the notification was received |
Art. 73(6) governs what follows the report. The provider performs the necessary investigations without delay, including a risk assessment of the incident and corrective action, and cooperates with the competent authorities and, where relevant, the notified body. The second subparagraph of Art. 73(6) forbids any investigation that alters the AI system in a way that may affect a subsequent evaluation of the causes of the incident, before the competent authorities are informed of that action. Art. 73(9) and 73(10) limit the duty to Art. 3(49)(c) incidents for providers already subject to equivalent Union reporting instruments and for devices under Regulations (EU) 2017/745 and (EU) 2017/746.
Regulation (EU) 2026/1744 did not amend Art. 73. It inserted Art. 75(1a), which, by way of derogation from Art. 73, requires providers of high-risk AI systems under the AI Office's competence pursuant to Art. 75(1) to report serious incidents to the AI Office, with Art. 73(2) to 73(9) applying mutatis mutandis; the AI Office transmits the information to the market surveillance authority of the Member State where the provider or its legal representative is situated. It applies from the Omnibus entry into force In force.
What changes for a provider or deployer
The periods in Art. 73(2) to 73(4) run from awareness or from a causal-link finding, and the finding is made from records. Art. 12(2) point (a) requires the logs of a high-risk system to record the events relevant for identifying situations that may result in a risk within the meaning of Art. 79(1), and Art. 9(2) point (c) requires the provider to evaluate the risks that post-market monitoring data reveals. The Art. 12 obligation page lists the testable elements a causal-link finding uses: a decision reconstructed from the logs alone, an event per risk indicator in the risk management file, and an event per model version, threshold or configuration change. Where those events are missing, the provider cannot date its own awareness, cannot link the output to the system version that produced it, and cannot show the authority under Art. 73(6) that no alteration preceded the notification.
PR-12-LOG v1.0 produces that evidence in four groups of steps. Step 18 triggers each risk indicator and records whether the mapped event fires. Step 19 applies a model version, threshold and configuration change and records the event with the candidate substantial modification marker. Steps 22 and 23 record the integrity mechanism of the log store and alter a copy to check that the verification detects it, which gives a reconstructed decision evidential value in an Art. 73(6) investigation. Steps 30 to 32 reconstruct the sampled decisions on the provider side and on the deployer side and compare them with the output store. The logging and human-oversight verification service runs the protocol within the limits at what we cannot do and returns the log completeness and continuity test report and the decision reconstruction record, both specified as a test report. Whether an observed event meets the Art. 3(49) definition is a classification the provider makes with its counsel; the test shows whether the logs can support that classification and the dates it depends on.
The deployer has its own route. Art. 26(5) requires a deployer that has identified a serious incident to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authorities, and applies Art. 73 mutatis mutandis where the deployer cannot reach the provider. The Art. 73(2) clock runs from the deployer's awareness where applicable, so the deployer's monitoring record under Art. 26(5) fixes the start date. Art. 26(6) requires the deployer to keep the logs under its control for a period appropriate to the intended purpose and of at least six months, which the Art. 26 obligation page lists as a testable element, with the retention configuration evidence as its artifact. The log completeness guide gives the schema validation and gap detection procedure a deployer can run on an exported log set.
What to do now
- Map each Art. 3(49) result, (a) to (d), to the risk indicators in the Art. 9 risk management file and to the log event that records each indicator; the Art. 12 obligation page names the mapping as a documentation element.
- Record, per system, the addressee of the report: the market surveillance authority of the Member State under Art. 73(1), the AI Office under Art. 75(1a), or the national competent authority chosen under Art. 73(10) for devices.
- Run PR-12-LOG v1.0 steps 18, 19, 22, 23 and 30 to 32 and close every gap that step 33 classes before the system is placed on the market.
- Write the Art. 73(6) investigation procedure so that every change to the system after an incident produces a
config.changedevent and the competent authority is informed before the change is made. - For a deployer, write the Art. 26(5) route from identification to the three notifications, and verify the Art. 26(6) retention configuration against the period the policy claims.
- Keep the awareness date, the causal-link finding and the report submission date as dated records, since Art. 99(7) names the manner in which the infringement became known, including whether the operator notified it, among the circumstances an authority weighs when it sets a penalty.
Related pages
The obligation pages, the protocol, the guide and the service below carry the detail for each step above.
- Protocols
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.