Obligations & assessments

Serious incident reporting

AI ActArt. 3(49) · Art. 73

Providers must report serious incidents to market surveillance authorities: death or serious harm to health, serious and irreversible disruption of critical infrastructure, breaches of obligations protecting fundamental rights, or serious harm to property or the environment. The general deadline is 15 days after becoming aware, and as little as 2 days for the most severe cases.

Often confused with

Personal data breach notification

GDPR breach notification is about personal data security (72 hours to the supervisory authority). AI Act incident reporting is about harm caused by the AI system.

Connected terms · 5

Corrective actions, withdrawal and recall Market surveillance authority Post-market monitoring Record-keeping (logging)Systemic-risk model obligations