Evidence Preservation (Art. 73(6)) Article 73(6) explicitly prohibits the provider from altering the AI system in a way that could affect subsequent evaluation of the incident’s causes, prior to informing the competent authorities. The engineering team preserves the system’s state at the time of the incident: model version, configuration, input data, output data, feature values, and all relevant logs. If the system is operating in a way that continues to cause harm, the break-glass procedure should be activated to stop processing. The system’s state must be captured before or simultaneously with the stop action. Automated snapshot scripts trigger on any critical-severity alert, capturing the current model state (version, configuration, parameters), inference logs for the incident period, monitoring metrics, the data pipeline state, and system configuration. The snapshot is written to immutable storage within minutes of the trigger. This evidence serves two purposes: the regulatory notification (which must describe the incident, the system involved, and the corrective actions taken) and any subsequent investigation by the competent authority. Key outputs

• System state preserved before any alteration
• Automated snapshot scripts on critical alert trigger
• Immutable storage for preserved evidence
• Break-glass activation with simultaneous state capture