Even well-tested AI systems can cause harm in use. The AI Act therefore requires providers of high-risk AI systems to report serious incidents so authorities can react and recognise patterns.
What a serious incident is
An incident or malfunction of an AI system that directly or indirectly leads to the death of a person or serious harm to health, a serious and irreversible disruption of the management or operation of critical infrastructure, an infringement of obligations protecting fundamental rights, or serious harm to property or the environment.
Deadlines
The report to the market surveillance authority is made immediately once the provider has established a causal link between system and incident or its reasonable likelihood, generally no later than 15 days after awareness. For a widespread infringement or serious disruption of critical infrastructure the deadline is no more than two days, for a death no more than ten days. An initial incomplete report is permitted and completed later.
Role of deployers
Deployers who identify a serious incident inform the provider immediately and, where applicable, the authority. Contracts with providers should therefore set out how and how quickly such information flows.
Interplay with other reporting duties
An AI incident may at the same time be a data breach, a cyberattack under the Swiss ISA or an incident under the Cyber Resilience Act. A shared incident response plan with all reporting channels prevents deadlines from being missed. The duty applies with the other high-risk obligations, under the Digital Omnibus from December 2027 for Annex III systems.