Reporting Timelines (2/10/15 Days) The reporting regime is tiered by severity. Two days from awareness: widespread infringement of fundamental rights, or serious and irreversible disruption to critical infrastructure. Ten days from awareness: death of a person or suspected causal link to a death. Fifteen days from awareness: all other serious incidents meeting the Article 3(49) definition. The clock starts when the provider “becomes aware” of the incident and establishes a causal link (or reasonable likelihood of one) between the AI system and the harm. In practice, awareness develops gradually: a deployer reports an anomaly, the engineering team investigates, the investigation reveals a potential causal link, and the legal team confirms the Article 3(49) definition is met. Internal processes must compress this chain because the two-day and ten-day timelines leave almost no margin. Article 73(5) permits submission of an initial, incomplete report followed by supplementary information. The Commission recognises that full root cause analysis cannot be completed within two days. The initial report should contain provider identity, system identity and registration details, incident description, suspected causal link, and immediate actions taken. Key outputs

• Three-tier timeline (2/10/15 days from awareness)
• “Awareness” definition including causal link establishment
• Initial incomplete report permitted with supplementary follow-up
• Internal process design to compress the awareness chain