What are the serious-incident reporting deadlines under the EU AI Act?

Under Article 73, reports to the market surveillance authority are due within tiered deadlines: 15 days generally, 10 days where a person's death is involved, and 2 days for a widespread infringement or an incident of particular severity. The clock starts once a causal link between the system and the incident is established or reasonably likely, not once it is proven.

Who is responsible for post-market monitoring?

Providers must run an active, proportionate monitoring system across the system's operational lifetime (Article 72); deployers must monitor real-world performance in their own context and report meaningful findings (degradation, unexpected behaviour, incidents) back to the provider.

EU AI Act

Post-market monitoring and serious incident reporting (Articles 72–73)

Updated 22 August 2026Sourced from Regulation (EU) 2024/1689 (the EU AI Act), Articles 72 and 73

In short

Pre-launch testing only proves a system worked in controlled conditions. Article 72 requires providers to run an active, proportionate post-market monitoring system across the whole operational lifetime, with deployers feeding back real-world findings. Article 73 requires serious incidents (death or serious health harm, critical-infrastructure disruption, cross-border fundamental-rights infringements, or serious property/ environmental harm) to be reported on tiered deadlines: 15 days generally, 10 days where a death is involved, and 2 days for widespread or particularly severe incidents. The clock starts once a causal link is established or reasonably likely, and root-cause analysis is required before returning to service.

Pre-deployment testing only shows a system worked in controlled conditions. Post-market monitoring is what catches degradation, drift, or emerging risks once the system is in real use (which is when most safety and fundamental-rights harms actually surface) and serious incident reporting is the escalation path when monitoring finds something that crosses a defined severity threshold.

The post-market monitoring system (Article 72)

Providers must establish a monitoring system proportionate to the system’s risk, actively and systematically collecting and analysing performance data throughout its operational lifetime, not passively waiting for complaints to surface. Deployers have a complementary duty: monitor the system’s real-world performance in their own context and report meaningful findings (degradation, unexpected behaviour, incidents) back to the provider, since the provider’s monitoring system depends on this real-use input.

What counts as a serious incident

Article 73 defines a serious incident as one that directly or indirectly leads, or might lead, to:

The death of a person, or serious harm to a person’s health.
A serious and irreversible disruption of the management or operation of critical infrastructure.
The infringement of obligations under Union law intended to protect fundamental rights, where affecting more than one Member State.
Serious harm to property or the environment.

Tiered reporting deadlines that start early

Providers (and deployers who become aware first) must report to the market surveillance authority of the Member State where the incident occurred within tiered deadlines: 15 days generally, 2 days for a widespread infringement or an incident of particular severity, and 10 days where a death is involved. The clock starts once a causal link between the system and the incident is established or reasonably likely, not once it is proven. An initial, incomplete report can and should be filed if the full picture is not yet known by the deadline, followed by a complete one once available.

Root cause analysis and returning to service

After any serious incident, a documented root cause analysis and corrective measures are required before the system is returned to service. A deployer that becomes aware a system presents a serious risk should suspend its use pending the provider’s or authority’s response, rather than continuing operation while waiting for a reply.

The most common failure here is not a missing reporting policy, but a monitoring gap that means an organisation only learns about a qualifying incident well after the reporting clock has already started, a documented incident-detection process, tied into ongoing monitoring, is what actually protects the 2-day and 10-day windows.

Frequently asked questions

What are the serious-incident reporting deadlines under the EU AI Act?: Under Article 73, reports to the market surveillance authority are due within tiered deadlines: 15 days generally, 10 days where a person's death is involved, and 2 days for a widespread infringement or an incident of particular severity. The clock starts once a causal link between the system and the incident is established or reasonably likely, not once it is proven.
What counts as a serious incident?: An incident that directly or indirectly leads, or might lead, to a person's death or serious harm to health; a serious and irreversible disruption of critical infrastructure; infringement of fundamental-rights obligations affecting more than one Member State; or serious harm to property or the environment.
Who is responsible for post-market monitoring?: Providers must run an active, proportionate monitoring system across the system's operational lifetime (Article 72); deployers must monitor real-world performance in their own context and report meaningful findings (degradation, unexpected behaviour, incidents) back to the provider.

Related guides

Not sure where your company stands?

Our free assessment gives you an indicative result in minutes (free and anonymous) no account needed.

Start the free check