Serious incidents meeting the Article 3(49) definition are reported to the market surveillance authority of the member state where the incident occurred. The timelines follow a tiered structure under Article 73(2)–(4): the default deadline is fifteen days after the provider or deployer becomes aware of the serious incident. A shortened two-day deadline applies to widespread infringements and to serious and irreversible disruption of critical infrastructure (Article 3(49)(b)). In the event of death, the deadline is ten days. Providers may submit an initial incomplete report under Article 73(5), followed by a complete report as the investigation progresses.

Article 73-specific fields include the suspected causal link between the AI system and the harm, the fundamental rights dimension, and the system’s EU database registration reference. These fields are prepared as a regime-specific annex to the shared incident fact sheet. The Legal and Regulatory Advisor coordinates the Article 73 report to ensure consistency with any parallel reports to other authorities.

Article 73(6) prohibits altering the AI system in a way that could affect subsequent evaluation of the causes before informing the competent authorities. The evidence preservation procedure must be executed before any system modification.

Key outputs

• Article 73 reporting stream (2d/10d/15d) to market surveillance authority
• Causal link, fundamental rights dimension, and EU database reference
• No-alteration obligation until authorities notified
• Module 9 and Module 12 AISDP documentation