What is a serious incident under the AI Act?
A serious incident (Article 3(49)) is an incident or malfunctioning of an AI system that directly or indirectly leads to: (a) the death of a person or serious harm to a person’s health; (b) a serious and irreversible disruption of the management or operation of critical infrastructure; (c) infringement of Union-law obligations intended to protect fundamental rights; or (d) serious harm to property or the environment. The definition is deliberately wide: limb (c) means an incident can be “serious” without anyone being physically hurt.
Reporting duties
- Providers of high-risk systems must report to the market surveillance authority of the Member State where the incident occurred — as a rule within 15 days of becoming aware, faster for the gravest cases (72 hours for a widespread infringement or serious and irreversible disruption of critical infrastructure);
- Deployers must inform the provider without delay — contracts should wire this handoff, with named contacts and timescales;
- GPAI models with systemic risk carry parallel incident-tracking and reporting duties under Article 55.
The legal dimension: one event, several regimes
Incident response is where AI compliance meets operations. Logging is your evidence and post-market monitoring is your detection; the same event can simultaneously be a KVKK or GDPR personal data breach with its own notification clock, a contractual notice trigger and a product-liability exposure. Investigate once, but map every regime the facts touch before the clocks run out.
Turkish context
Türkiye has no AI-specific incident-reporting duty in force; KVKK breach notification and general liability rules govern domestically. Turkish providers whose high-risk systems reach the EU market report under the Act like any other provider — and the awareness clock does not wait for head office in Türkiye. The playbook therefore has to exist before the incident: intake, classification, counsel, notification templates.
Do: run a tabletop exercise pairing engineering and legal on a fictitious incident, and pre-draft the report skeleton. Don’t: treat the 15-day clock as the plan itself — classification and evidence-gathering consume it faster than teams expect.
Related guides: When the Model Causes Harm.
Sources. Regulation (EU) 2024/1689 (AI Act) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.