Skip to content

Regulation Tracker / EU AI Act / Chapter IX · Section 2

Article 73
Reporting of serious incidents

Chapter IX — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems, Section 2 — Reporting of serious incidents. 12 distinct duties, powers or definitions are coded from this article, applying from 2026-08-02. 10 reach legal practice directly.

Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27 — about 83 words changed. The text below is the consolidated version of 27 July 2026; the 2024 text and the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.

2. The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident.

3. Notwithstanding paragraph 2 of this Article, in the event of a widespread infringement or a serious incident as defined in Article 3, point (49)(b), the report referred to in paragraph 1 of this Article shall be provided immediately, and not later than two days after the provider or, where applicable, the deployer becomes aware of that incident.

4. Notwithstanding paragraph 2, in the event of the death of a person, the report shall be provided immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident, but not later than 10 days after the date on which the provider or, where applicable, the deployer becomes aware of the serious incident.

5. Where necessary to ensure timely reporting, the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report.

6. Following the reporting of a serious incident pursuant to paragraph 1, the provider shall, without delay, perform the necessary investigations in relation to the serious incident and the AI system concerned. This shall include a risk assessment of the incident, and corrective action.

7. Upon receiving a notification related to a serious incident referred to in Article 3, point (49)(c), the relevant market surveillance authority shall inform the national public authorities or bodies referred to in Article 77(1). The Commission shall develop dedicated guidance to facilitate compliance with the obligations set out in paragraph 1 of this Article. That guidance shall be issued by 2 August 2025, and shall be assessed regularly.

8. The market surveillance authority shall take appropriate measures, as provided for in Article 19 of Regulation (EU) 2019/1020, within seven days from the date it received the notification referred to in paragraph 1 of this Article, and shall follow the notification procedures as provided in that Regulation.

9. For high-risk AI systems referred to in Annex III that are placed on the market or put into service by providers that are subject to Union legislative instruments laying down reporting obligations equivalent to those set out in this Regulation, the notification of serious incidents shall be limited to those referred to in Article 3, point (49)(c).

10. For high-risk AI systems which are safety components of devices, or are themselves devices, covered by Regulations (EU) 2017/745 and (EU) 2017/746, the notification of serious incidents shall be limited to those referred to in Article 3, point (49)(c) of this Regulation, and shall be made to the national competent authority chosen for that purpose by the Member States where the incident occurred.

11. National competent authorities shall immediately notify the Commission of any serious incident, whether or not they have taken action on it, in accordance with Article 20 of Regulation (EU) 2019/1020.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

  1. Art. 73(1)Incident reportingHigh-risklegal practice

    Providers of high-risk AI systems placed on the Union market must report any serious incident to the market surveillance authorities where the incident occurred.

    "Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — Legal-AI vendors of high-risk systems must report serious incidents in the relevant Member State.
    See
    Art. 3(49)

  2. Art. 73(2)Incident reportingHigh-risklegal practice

    The serious-incident report must be made immediately after causal link or reasonable likelihood is established, and no later than 15 days after awareness.

    "not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — This fixes the ordinary reporting deadline for high-risk legal-AI serious incidents.
    See
    Art. 73(1)

  3. Art. 73(3)Incident reportingHigh-risklegal practice

    For a widespread infringement or an Article 3(49)(b) serious incident, the report must be immediate and no later than two days after awareness.

    "the report referred to in paragraph 1 of this Article shall be provided immediately, and not later than two days after the provider or, where applicable, the deployer becomes aware of that incident."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — High-risk legal-AI providers have a shorter two-day deadline for the specified serious incidents.
    See
    Art. 3(49)(b) · Art. 73(1)

  4. Art. 73(4)Incident reportingHigh-risklegal practice

    Where a serious incident involves a death, the report must be immediate after causal relationship is established or suspected, and no later than 10 days after awareness.

    "in the event of the death of a person, the report shall be provided immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship"
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — This special deadline applies to high-risk systems, including any high-risk legal AI linked to death.
    See
    Art. 73(1)

  5. Art. 73(5)Incident reportingHigh-risklegal practice

    Where needed for timely reporting, the provider or applicable deployer may submit an incomplete initial report followed by a complete report.

    "the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report."
    Who
    Provider, Deployer
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — This permits staged reporting for high-risk legal-AI incidents when complete facts are not yet available.
    See
    Art. 73(1)

  6. Art. 73(6)Incident reportingHigh-risklegal practice

    After reporting a serious incident, the provider must investigate without delay, including risk assessment of the incident and corrective action.

    "the provider shall, without delay, perform the necessary investigations in relation to the serious incident and the AI system concerned. This shall include a risk assessment of the incident, and corrective action."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — A high-risk legal-AI provider must investigate reported incidents and take corrective action.
    See
    Art. 73(1)

  7. Art. 73(7)Support measureHigh-risklegal practice

    The Commission must develop dedicated serious-incident reporting guidance by 2 August 2025 and assess it regularly.

    "The Commission shall develop dedicated guidance to facilitate compliance with the obligations set out in paragraph 1 of this Article. That guidance shall be issued by 2 August 2025, and shall be assessed regularly."
    Who
    Commission
    From
    (Art. 113 second subparagraph (general application))Guidance deadline: 2 August 2025.
    Legal practice
    Reaches legal practice directly — The guidance informs high-risk legal-AI serious-incident reporting practice.
    See
    Art. 73(1)

  8. Art. 73(7)Cooperation with authoritiesHigh-risklegal practice

    When notified of an Article 3(49)(c) serious incident, the relevant market surveillance authority must inform the fundamental-rights authorities or bodies referred to in Article 77(1).

    "the relevant market surveillance authority shall inform the national public authorities or bodies referred to in Article 77(1)."
    Who
    Market surveillance authority
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — Serious incidents affecting fundamental-rights obligations may reach equality, data-protection or similar authorities relevant to legal disputes.
    See
    Art. 3(49)(c) · Art. 77(1)

  9. Art. 73(8)Enforcement powerHigh-risklegal practice

    The market surveillance authority must take appropriate Regulation 2019/1020 measures within seven days of receiving a serious-incident notification and follow notification procedures.

    "The market surveillance authority shall take appropriate measures, as provided for in Article 19 of Regulation (EU) 2019/1020, within seven days from the date it received the notification"
    Who
    Market surveillance authority
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — This governs regulatory response to serious incidents involving high-risk legal AI.
    See
    Regulation (EU) 2019/1020 Article 19 · Art. 73(1)

  10. Art. 73(9)Derogation or exemptionHigh-risk

    For Annex III high-risk systems covered by equivalent Union reporting instruments, serious-incident notification is limited to Article 3(49)(c) incidents.

    "the notification of serious incidents shall be limited to those referred to in Article 3, point (49)(c)."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal-AI vendors or public bodies — This may affect high-risk legal-sector systems only if equivalent Union reporting obligations already apply.
    See
    Annex III · Art. 3(49)(c)

  11. Art. 73(10)Incident reportingHigh-risk

    For high-risk AI that is, or is a safety component of, covered medical devices, Article 3(49)(c) serious incidents must be notified to the chosen national competent authority.

    "shall be made to the national competent authority chosen for that purpose by the Member States where the incident occurred."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Fine tier
    Art. 99(4)
    Legal practice
    Institutional — This is mainly relevant to medical-device AI rather than legal practice.
    See
    Regulation (EU) 2017/745 · Regulation (EU) 2017/746 · Art. 3(49)(c)

  12. Art. 73(11)Cooperation with authoritiesHigh-risklegal practice

    National competent authorities must immediately notify the Commission of any serious incident, whether or not they have acted on it.

    "National competent authorities shall immediately notify the Commission of any serious incident, whether or not they have taken action on it, in accordance with Article 20 of Regulation (EU) 2019/1020."
    Who
    National competent authority
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — This ensures Commission visibility of serious incidents involving high-risk systems, including legal-sector systems.
    See
    Regulation (EU) 2019/1020 Article 20

Cite

Regulation (EU) 2024/1689, Article 73 (Reporting of serious incidents), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_73 — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-73, accessed 2026-09-08, CC BY 4.0.