EU AI Act Serious Incident Report Template (Article 73)
A serious incident report template for EU AI Act Article 73: the fields to capture and the deadlines — 15 days, 10 on death, 2 for critical cases.
When a high-risk AI system is involved in a serious incident, Article 73 of the EU AI Act, Regulation (EU) 2024/1689, requires the provider to report it to the market-surveillance authority of the member state where the incident occurred. This page gives a ready report structure and the deadlines that govern it. It is the fillable companion to the incident-reporting concept guide.
A "serious incident" is defined in Article 3(49): an incident or malfunctioning of an AI system that directly or indirectly leads to death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of fundamental-rights obligations, or serious harm to property or the environment.
Who reports, and to whom
Article 73 is the provider's duty. The provider reports to the market-surveillance authority of the member state where the incident occurred. A deployer's role is different: under Article 26, the deployer must monitor the system, and where it identifies a serious incident, inform the provider (and, where relevant, the authority). So the deployer's first move is usually to notify the provider, who then carries the Article 73 report.
The reporting deadlines (lock these)
Report immediately after the provider establishes a causal link, and no later than:
- 15 days after awareness, as the general rule (Article 73(2));
- 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure (Article 73(3));
- 10 days where the incident involved a person's death (Article 73(4)).
An incomplete initial report is permitted to meet the deadline, followed by a complete report (Article 73(5)). Do not wait for full certainty before filing the initial notice.
The template — fields to capture
1. Reporting entity
- Provider name, role (provider / deployer flagging to provider), contact point, EU authorised representative (Article 22) if non-EU.
2. System identification
- System name and version; intended purpose; Annex III category (or Annex I route); EU database registration reference (Article 49); CE marking status.
3. Incident summary
- Date and place of occurrence; date of awareness; which Article 3(49) limb applies (death/health, critical-infrastructure disruption, fundamental-rights breach, property/environmental harm); a factual description.
4. Impact
- Persons affected; nature and severity of harm; whether harm is reversible; scope (single vs widespread).
5. Causal analysis
- Suspected or established causal link between the system and the incident; component or behaviour implicated; whether the system operated within its intended purpose.
6. Immediate measures
- Corrective actions taken; whether the system has been withdrawn, paused, or restricted; deployer instructions issued.
7. Deadline tracking
- Awareness date; which deadline applies (15 / 10 / 2 days); initial-report date; complete-report due date.
8. Follow-up
- Root-cause investigation status; planned corrective and preventive actions; links to the Article 9 risk-management record and Article 12 logs.
Worked example: a credit-scoring provider
Adelmann Score GmbH, a 40-person provider of a high-risk credit-scoring system (Annex III point 5(b)), discovers that a data fault produced systematically unfair declines for a class of applicants — an infringement of fundamental-rights obligations under Article 3(49). It is not a death case and not critical-infrastructure, so the 15-day rule applies. The firm files an initial report within days noting the suspected causal link and the applicants affected, pauses the scoring feature, and follows up with a complete report once root cause is confirmed. The Article 12 logs and Article 9 records feed directly into sections 5 and 8.
How Confir helps
Confir keeps the system identification, Annex III category, Article 49 registration and Article 12 log references in one record, so a serious-incident report assembles from data you already hold rather than from scratch under deadline pressure. It tracks which Article 73 deadline applies from the awareness date, and distinguishes the provider's Article 73 reporting duty from the deployer's Article 26 flag-to-provider duty. The engine is deterministic and rule-based.
Frequently asked questions
Who must file a serious incident report under the EU AI Act?
The provider of the high-risk AI system, under Article 73, reports to the market-surveillance authority of the member state where the incident occurred. A deployer's duty under Article 26 is to monitor the system and inform the provider (and, where relevant, the authority) of a serious incident — so deployers typically notify the provider, who then files the Article 73 report.
What counts as a serious incident?
Article 3(49) defines it as an incident or malfunctioning that directly or indirectly leads to death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of fundamental-rights obligations, or serious harm to property or the environment.
What are the Article 73 reporting deadlines?
Report no later than 15 days after awareness as the general rule (73(2)); within 2 days for a widespread infringement or serious, irreversible critical-infrastructure disruption (73(3)); and within 10 days where a person has died (73(4)). An incomplete initial report is allowed to meet the deadline, followed by a complete report (73(5)).
When do these obligations start to apply?
Serious-incident reporting attaches to high-risk systems. Stand-alone high-risk Annex III obligations originally read 2 August 2026 in the statute, but the Digital Omnibus — adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026 — defers this to 2 December 2027. It enters into force on Official Journal publication, expected before 2 August 2026, so plan against 2 December 2027.
What is the penalty for failing to report?
Failure to meet operator obligations such as incident reporting falls in the Article 99(4) tier — up to €15 million or 3% of total worldwide annual turnover, whichever is higher. SMEs and start-ups are capped at the lower of the percentage or the fixed amount under Article 99(6).
Related guides
- Incident reporting under the EU AI Act
- Annex III high-risk use cases
- Provider versus deployer roles
- Article 26 deployer obligations
- Human oversight protocol template
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →