Template · Written by Yobel Tzegai · Last checked 9 October 2026
Which kind of serious incident under Article 3, point (49) it is, when the provider or, where applicable, the deployer became aware of it and which limit runs from that day: 15 days at the latest, 10 days for a death and two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, each with its own trigger for reporting immediately (Article 73(2) to (4)). This free template from complipath.io adds who reported to which authority and marks which fields Article 73 asks for and which are practice.
| Column | What goes in it | Provision |
|---|---|---|
| Incident reference | Practical field: your own number for the incident. The Regulation does not ask for one. | Practice, not law |
| AI system and classification | The high-risk system concerned, with the provision it is high-risk under. Article 73(1) binds providers of high-risk AI systems placed on the Union market. | Article 73(1) |
| Your role | Provider, who reports under Article 73(1), or deployer, who informs the provider first under Article 26(5). | Article 73(1) and Article 26(5) |
| What happened | The incident or malfunctioning of the system, and what it directly or indirectly led to. | Article 3, point (49) |
| Kind of serious incident | Point (a), the death of a person or serious harm to a person's health; point (b), a serious and irreversible disruption of the management or operation of critical infrastructure; point (c), the infringement of obligations under Union law intended to protect fundamental rights; point (d), serious harm to property or the environment. | Article 3, point (49) |
| Widespread infringement | Yes or no, against the whole definition in Article 3, point (61). If yes, the two-day limit of Article 73(3) applies. | Article 3, point (61); Article 73(3) |
| Member States where it occurred | The report goes to the market surveillance authorities of the Member States where the incident occurred. | Article 73(1) |
| Became aware on | The date the provider or, where applicable, the deployer became aware of the incident. Every outer limit runs from it. | Article 73(2) to (4) |
| Causal link | When the provider established a causal link between the system and the incident, or the reasonable likelihood of one, which makes the report due immediately. For a death, when the provider or the deployer established, or first suspected, a causal relationship. | Article 73(2) and (4) |
| Limit that applies | Not later than 15 days after awareness (Article 73(2)), two days for a widespread infringement or a point (49)(b) incident (Article 73(3)), 10 days for a death (Article 73(4)); each paragraph also says immediately from its own trigger, and the period in Article 73(2) takes account of the incident's severity. | Article 73(2) to (4) |
| Latest report date | Practical field: the awareness date plus the limit, worked out in advance so that nobody counts days under pressure. | Practice, not law |
| Reported to | The market surveillance authority of each Member State concerned (Article 73(1)); instead, the AI Office, for a provider within its exclusive competence under Article 75(1) (Article 75(1a), inserted by Regulation (EU) 2026/1744); for devices under Regulations (EU) 2017/745 and (EU) 2017/746, the national competent authority chosen for that purpose, and only point (49)(c) incidents (Article 73(10)). Where Article 73(9) applies, only point (49)(c) incidents are notified. | Article 73(1), (9) and (10), and Article 75(1a) |
| Initial report sent | The date of an incomplete initial report, where one is necessary to report on time. | Article 73(5) |
| Complete report sent | The date of the complete report that follows it. | Article 73(5) |
| Deployer: who was told, and when | For a deployer: the provider first, then the importer or distributor and the relevant market surveillance authorities, immediately. If the provider cannot be reached, Article 73 applies mutatis mutandis. Sensitive operational data of deployers that are law enforcement authorities are not covered. | Article 26(5) |
| Investigation and corrective action | The provider's investigation without delay, including a risk assessment of the incident and corrective action, in cooperation with the competent authorities and, where relevant, the notified body concerned. | Article 73(6) |
| Authorities told before altering the system | The date the competent authorities were informed before any investigation that alters the system in a way that may affect a later evaluation of the causes. | Article 73(6), second subparagraph |
| Owner | Practical field: the person who runs this incident to its close. | Practice, not law |
| Status | Practical field: open, reported or closed. | Practice, not law |
| Incident reference | AI system and classification | Your role | What happened | Kind of serious incident | Widespread infringement | Member States where it occurred | Became aware on | Causal link | Limit that applies | Latest report date | Reported to | Initial report sent | Complete report sent | Deployer: who was told, and when | Investigation and corrective action | Authorities told before altering the system | Owner | Status |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| [Reference] (example) | Harbrook CV screening, point 4(a) of Annex III | Deployer | [What happened, in plain words] | Point (c), infringement of obligations under Union law intended to protect fundamental rights | No | [Member State] | [Date] | [For the provider to establish] | 15 days at the latest (Article 73(2)) | [Date] | For the provider: [authority] | For the provider: [date] | For the provider: [date] | Provider [date], then distributor [date] and market surveillance authority [date] | For the provider: [summary] | For the provider: [date] | [Name] | Open |
| [Reference] (example) | [System Harbrook provides], with the point of Annex III it is high-risk under | Provider | [What happened, in plain words] | Point (a), serious harm to a person's health | No | [Member State] | [Date] | [Date the link was established, or its reasonable likelihood] | 15 days at the latest, and immediately once the link is established (Article 73(2)) | [Date] | [Market surveillance authority] | [Date] | [Date] | Not applicable: Harbrook is the provider | [Investigation, risk assessment and corrective action] | [Date] | [Name] | Reported |
Complipath has no serious incident log, and the app lists Serious incidents as not built; what it has is the step-by-step plan, which carries Report serious incidents as a step to keep doing for each high-risk system you provide, quoting Article 73(1) and asking for a written incident procedure with the deadlines as proof. Step-by-step plan.
Article 3, points (49) and (61); Article 17(1), point (i); Article 26(5); Article 73; Article 75(1a), inserted by Regulation (EU) 2026/1744; Article 113, second paragraph; Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
€499 a month
Prices exclude VAT.
Not by that name. Article 73 requires providers of high-risk systems to report serious incidents within its limits and to investigate them, and Article 17(1), point (i) requires their quality management system to include procedures for reporting serious incidents in accordance with Article 73. A log is how you show the dates those limits run from.
Not later than 15 days after the provider or, where applicable, the deployer becomes aware (Article 73(2)); two days for a widespread infringement or a point (49)(b) incident (Article 73(3)); 10 days for a death (Article 73(4)). Each also says immediately from its own trigger. An incomplete initial report may come first, followed by a complete one (Article 73(5)).
Article 73 takes the general date, 2 August 2026 (Article 113, second paragraph). It binds providers of high-risk systems, and the classification rules apply from 2 December 2027 for Annex III and 2 August 2028 for Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744). How the two fit is an open question.
A deployer that has identified a serious incident immediately informs first the provider, then the importer or distributor and the relevant market surveillance authorities (Article 26(5)). If it cannot reach the provider, Article 73 applies to it mutatis mutandis. The duty does not cover sensitive operational data of deployers that are law enforcement authorities.