Glossary · EU AI Act: high-risk AI
Serious incident (AI Act)
Also known as: Serious incident reporting (AI Act), AI Act incident reporting
German: Schwerwiegender Vorfall (KI-Verordnung)
Under the EU AI Act, a serious incident is an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of Union-law obligations protecting fundamental rights, or serious harm to property or the environment; providers of high-risk AI systems must report it to the market surveillance authorities under Article 73.
- AI regulation
- EU
In one sentence
Serious incident under the AI Act: death, serious harm, infrastructure disruption, rights or property harm — reported within 15, 10 or 2 days.
Example
An AI system that schedules maintenance in a water utility suppresses alarms and causes a serious, irreversible disruption of supply; the provider reports it within two days of becoming aware.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: Check the reporting dutiesStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Reporting duties after an AI agent incident: AI Act, CRA, NIS 2 and GDPRWhen an AI agent has caused an incident, which EU reporting duties can apply — who reports, to whom, and by when?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
How it applies
- Definition (Art. 3(49)): An incident or malfunctioning that directly or indirectly leads to (a) death or serious harm to a person's health, (b) a serious and irreversible disruption of the management or operation of critical infrastructure, (c) an infringement of obligations under Union law intended to protect fundamental rights, or (d) serious harm to property or the environment.
- Deadlines (Art. 73): The provider reports to the market surveillance authorities of the Member State where the incident occurred, immediately after establishing a causal link or its reasonable likelihood, and not later than 15 days after the provider or the deployer becomes aware. Two days for a widespread infringement or a disruption of critical infrastructure; ten days in the event of a death. An incomplete initial report may be followed by a complete one.
- Deployers: A deployer that identifies a serious incident informs the provider first, then the importer or distributor and the market surveillance authorities (Art. 26(5)).
- When it applies: With the high-risk obligations — December 2, 2027 for Annex III systems and August 2, 2028 for Annex I Section A products, as set by the Digital Omnibus on AI. Machinery sits in Annex I Section B since Regulation (EU) 2026/1744; check the route under the Machinery Regulation before relying on Article 73 there.
- AI agents: An agent that is part of a high-risk AI system — for example in critical infrastructure — falls under these duties through that system. Whether an agent incident is “serious” depends on its consequences, not on the technology.
Serious incident (AI Act) vs. severe incident (CRA)
The AI Act's serious incident is defined by harm to people, infrastructure, rights, property or the environment. The severe incident of the Cyber Resilience Act is defined by the effect on the security of a product with digital elements. One event can be both, with different addressees and deadlines.