How long do we have to report a serious AI incident, and who do we tell?

The questions that decide it

• A short set of questions, each Yes, No or Not sure; each names the provision it comes from, in Article 3, point (49), or in Article 73.
• Could it have harmed someone's health or safety? Did anyone die? Did it seriously and irreversibly disrupt critical infrastructure, such as power, water or transport?
• Could it break a rule that protects people's rights, like non-discrimination? Could it have caused serious harm to property or the environment? Did it reach many people or several countries?
• The last stands in plain words for the widespread infringement of Article 73(3), a defined term in Article 3, point (61).
• The answers give a reading, So far this looks serious, Not clear yet or From your answers this does not look serious, which is not a decision. A person decides with a written reason, and the decision keeps the name and the day.

The deadline the law sets

• Article 73(2): the report is made immediately after the provider has established a causal link or its reasonable likelihood and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware. The period takes account of the severity.
• Article 73(3): two days, and immediately, for a widespread infringement or a serious incident under Article 3, point (49)(b), a serious and irreversible disruption of the management or operation of critical infrastructure.
• Article 73(4): in the event of the death of a person, ten days after becoming aware, and immediately once a causal relationship has been established or is suspected.
• Complipath counts calendar days from the day you became aware, which cannot be in the future. Not sure and unanswered count as Yes, so it shows the shortest date that could apply and the answer that would move it.
• The owner is reminded once when the date is three days away or less and once on the day, while the incident is open and nobody has decided it is not serious.

Who is told

• A provider: the market surveillance authorities of the Member States where the incident occurred (Article 73(1)).
• A provider under the AI Office's competence under Article 75(1), as replaced, reports to the AI Office instead, with Article 73(2) to (9) applying mutatis mutandis (Article 75(1a)). The register does not record that competence, so the app shows both routes and you decide.
• A deployer: immediately, first the provider, then the importer or distributor and the relevant market surveillance authorities. If the provider cannot be reached, Article 73 applies to the deployer mutatis mutandis (Article 26(5)).
• Article 26(5) adds that this obligation does not cover sensitive operational data of deployers of AI systems which are law enforcement authorities. The app does not show that sentence.
• Article 73 concerns high-risk AI systems. Where the register does not confirm the system as high-risk, the page says the date applies only if it is one.

The GDPR line beside it

• Answer Yes or Not sure to Did it involve personal data? and the page adds a GDPR line: tell the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, shown as the day you became aware plus three days.
• That line is a short form. The provision, GDPR Article 33(1), is quoted in full under The law this rests on: it applies unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and a notification after 72 hours must give reasons for the delay.
• NIS2 shows only if an admin ticks that it applies to your company, and then without a date. Complipath has not checked that law's text, so it points you to your national CSIRT or authority.

The report

• Draft the report builds an initial report from what you logged and the register: the system, its purpose, vendor, model and risk class, the day you became aware, the due date, what happened, the answers, the decision with its reason, the cause and the corrective actions.
• It is marked as an initial report. Article 73(5) allows an incomplete first report followed by a complete one, so what is not known yet is marked, not guessed.
• Nothing in it is written by AI: rules assemble it from your entries. You check every line and send it yourself. Complipath sends nothing to an authority.
• The format is Complipath's own. Article 73(7) asked the Commission for guidance by 2 August 2025; it was not in Complipath's sources on 20 October 2026, so check whether your authority asks for its own form.
• Two dates of your own sit beside the legal one: a first report within 24 hours and a cause report within two weeks. They are not from the Regulation, and each can be marked as sent.

What it does not do

• It does not apply Article 73(9) and (10): for some Annex III systems and for devices under Regulations (EU) 2017/745 and (EU) 2017/746, notification is limited to the incidents of Article 3, point (49)(c).
• It does not decide whether a system falls under the AI Office's competence, or whether an incident is serious. A person records both.
• A practice run tests your process: nothing is reported, nobody is reminded and it is never counted as an incident. Its draft opens with PRACTICE RUN and says it is not a report and is not to be sent.

Which plan

Growth feature, included in Starter and in the trial until Growth launches. On Free the page shows what it does, locked, with a link to choose Starter.