Obligations
Serious-incident reporting (Article 73)
When a high-risk system causes a serious incident, providers must report it to the authorities — within deadlines that vary by severity. The definition, the clocks, and who does what.
Updated 3 July 2026 · Reference material, not legal advice
High-risk systems come with a post-market obligation many teams overlook: reporting serious incidents to the authorities, under Article 73, within deadlines that depend on how severe the incident is.
What counts as a serious incident
Article 3(49) defines it as an incident or malfunction that directly or indirectly leads to:
- the death of a person or serious harm to health;
- a serious and irreversible disruption of critical infrastructure;
- an infringement of Union-law obligations protecting fundamental rights;
- serious harm to property or the environment.
The reporting clocks
The provider reports to the market-surveillance authority of the Member State where the incident occurred, as soon as a causal link is established, and no later than:
- 15 days — general rule, from awareness;
- 2 days — for a widespread infringement or an incident under Article 3(49)(b);
- 10 days — in the event of a person’s death.
An initial, incomplete report may be filed first, followed by a full one. The market-surveillance authority must act within 7 days of notification. The Commission has issued dedicated guidance to support compliance.
Who reports
The obligation sits with the provider. A deployer who identifies a serious incident informs the provider immediately (and, where the provider cannot be reached, the reporting duty applies to the deployer). Providers of general-purpose AI models with systemic risk have their own incident-reporting duties to the AI Office under Article 55.
Why it matters
Incident reporting is a live obligation with tight, severity-based deadlines. Missing the window is itself a breach — and the clock starts the moment you become aware, not when it is convenient.
What this means in practice
Euridium encodes these reporting clocks as concrete timelines, so a serious incident triggers the right deadline and the right recipient rather than an ad-hoc scramble.
Run a guided assessment and get the obligations that apply to your role.
This guide is a plain-language summary for orientation. The authoritative text is Regulation (EU) 2024/1689 as published in the Official Journal of the European Union (12 July 2024). It does not constitute legal advice.