Binds: Operator (see the article)
All obligations
EU AI Act Art.73: Reporting of serious incidents
Article 73 of the EU AI Act binds the operator (see the article). It requires Providers of high-risk AI systems placed on the Union market must report any serious incident to the market surveillance authorities. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.73 |
| Binds | Operator (see the article) |
| Group | Post-Market Monitoring, Market Surveillance and Rights |
| Evidence items | 6 |
| Linked NIST AI RMF controls | 3 |
| Linked ISO/IEC 42001 controls | 2 |
| Last updated |
Who does Art.73 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.73 require?
Providers of high-risk AI systems placed on the Union market must report any serious incident to the market surveillance authorities of the Member State where the incident occurred. The report must be made immediately after the provider has established a causal link between the AI system and the incident, or the reasonable likelihood of such a link, and in any event no later than fifteen days after becoming aware of it. That deadline is two days in the event of a widespread infringement or an incident consisting of a serious and irreversible disruption to the management or operation of critical infrastructure, and ten days where a person has died. An initial incomplete report may be submitted where necessary to ensure timely reporting, followed by a complete report. After reporting, the provider must without delay carry out the necessary investigations including a risk assessment of the incident and corrective action, cooperate with the competent authorities and any relevant notified body, and must not carry out any investigation that alters the AI system in a way that could affect a subsequent evaluation of the causes without first informing the competent authorities.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.73 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.73?
| Category | Evidence to keep |
|---|---|
| Incident reporting | An incident procedure distinguishing the fifteen day, ten day and two day deadlines, naming who classifies an incident |
| Incident reporting | Incident records showing the date of awareness, the date the causal link was established or judged reasonably likely, and the date reported |
| Incident reporting | Reports made to the market surveillance authority of the Member State where the incident occurred |
| Incident reporting | Post-report investigation records including the risk assessment of the incident and the corrective action taken |
| Incident reporting | Evidence the competent authorities were informed before any change was made to the system that could affect a causal evaluation |
| Incident reporting | Where used, the initial incomplete report and the complete report that followed it |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.73?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-4.3 | Organizational practices are in place to enable AI testing, identification of incidents, and information sharing Serious incident identification, causal determination and reporting is the incident and information-sharing practice. | high |
AIRMF-MN-4.3 | Incidents and errors are communicated to relevant AI actors including affected communities, and processes for tracking, responding to, and recovering from incidents and errors are followed and documented Incident reporting with causal link, follow-up and corrective measures is the tracking and recovery process. | high |
AIRMF-MS-3.1 | Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts Incident reporting captures materialised harm rather than tracking emergent risk. | medium |
Which ISO/IEC 42001 controls line up with Art.73?
2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.3.3 | Reporting of concerns Serious incident reporting procedure covers escalation of AI system concerns. | medium |
A.8.4 | Communication of incidents Serious incidents reported to market surveillance authorities within fixed deadlines. | high |
What does the conformance kit add for Art.73?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.