When must a serious AI incident be reported, and to whom?

What it does

• You log an incident against one AI system: a line, what happened, the day you became aware, which cannot be in the future, and whether you build the system or use it.
• The questions, each Yes, No or Not sure: harm to health, a death, a serious and irreversible disruption of critical infrastructure, fundamental rights, property or the environment. The last asks whether it reached many people or several countries. Each names the provision it comes from.
• The date: 15 days after you became aware under Article 73(2), 10 on a death under Article 73(4), 2 for a serious and irreversible disruption of critical infrastructure or a widespread infringement under Article 73(3). Counted in calendar days.
• Not sure and unanswered count as yes for the date, so the shortest date that could apply is shown, with the answer that would move it.
• Who is told, by your role. As provider: the market surveillance authorities of the Member States where it occurred. As deployer: first the provider, then the importer or distributor and the authorities, immediately; if you cannot reach the provider, you report as the provider would.
• A reading from your answers, Looks serious, Not clear yet or Does not look serious, which is not a decision. A person records Serious, or Not serious with a reason, and the row keeps the name and the day.
• Draft the report builds an initial report from what you logged, marking what is not known yet. Nothing in it is written by AI.
• The owner gets an email once the date is three days away or less, and one more on the day, while the incident is open and nobody has decided it is not serious. If no member owns it, the workspace's admins get it.

Who it is for

Providers and deployers of AI systems who need to know, on the day something goes wrong, whether a report may be due, by when and to whom. A provider's duty is in Article 73 and a deployer's in Article 26(5); both concern high-risk AI systems.

How you use it, step by step

• Open Incidents in the sidebar under Govern and choose Log an incident.
• Pick the system, say what went wrong in a line, give the day you became aware and whether you build it or use it.
• Answer the questions you can. Leave the rest Not sure until you know: the date stays at the shortest that could apply.
• Choose the owner from the members of your workspace, and keep the status Open, Reported or Closed.
• When you know, record It is serious, or Not serious with the reason. Not serious removes the date and stops the reminders.
• Open Draft the report, check every line and send it yourself.

Which plan

Growth feature · included in Starter until Growth launches. The trial and every paid plan open it, and the reminder is sent only to those workspaces. On Free, Incidents shows what it does, locked, with a link to the plans.

Where it sits in the law

• Article 3, point (49): an incident or malfunctioning that directly or indirectly leads to a death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of Union-law obligations protecting fundamental rights, or serious harm to property or the environment.
• Article 73(1): providers of high-risk AI systems placed on the Union market report a serious incident to the market surveillance authorities of the Member States where it occurred.
• The days are outer limits. Article 73(2) asks for the report immediately once a causal link or its reasonable likelihood is established, and says the period takes account of the incident's severity. Article 73(3) and (4) also say immediately.
• Article 26(5): a deployer that has identified a serious incident immediately informs first the provider, then the importer or distributor and the relevant market surveillance authorities. If it cannot reach the provider, Article 73 applies to it mutatis mutandis.
• Regulation (EU) 2026/1744 amends none of these provisions, but inserts Article 75(1a): a provider of a high-risk system under the AI Office's competence under Article 75(1), as replaced, reports to the AI Office, with Article 73(2) to (9) applying mutatis mutandis.
• The AI Office then passes the information to the market surveillance authority of the Member State where the provider or its legal representative is situated.

What it does not do

• It sends nothing to an authority or to the provider. The draft is text for you to check and send.
• It does not ask whether your system falls under the AI Office's competence under Article 75(1), as replaced. Where it does, a provider reports to the AI Office under Article 75(1a); the app still names the market surveillance authorities.
• It does not apply Article 73(9): for Annex III systems of providers under Union reporting duties equivalent to the Regulation's, only incidents under Article 3, point (49)(c), are notified.
• It does not apply Article 73(10): for systems that are devices under Regulations (EU) 2017/745 and (EU) 2017/746, or their safety components, only point (49)(c) incidents are notified, to the national competent authority chosen for that purpose by the Member States where it occurred.
• The date is worked out for any system. Article 73 concerns high-risk systems, so where the register holds no confirmed high-risk class, the page says the date applies only if the system is one.
• Its widespread question asks in plain words about many people or several countries. The defined term, Article 3, point (61), turns on harm to the collective interests of individuals across Member States.
• It covers the serious-incident duty in Article 26(5) only, not the deployer's other duties there: monitoring the system, and informing and suspending use where its use may result in a risk within the meaning of Article 79(1).
• It does not track the investigation and corrective action Article 73(6) asks of a provider after reporting; the draft leaves that line for you.
• The reminder rides a daily run, reaches an owner only if the owner is a member, and stops if the workspace falls to Free.

Where it is in the app

In the sidebar, under Govern, as Incidents. The list is on the left; the chosen incident opens on the right with its date, who is told, the questions, the decision, the draft and the provisions it rests on, quoted in full.

The Leadership dashboard lists each open incident's date and flags those with no decision.