What is a serious incident under the AI Act?
A serious incident (Article 3(49)) is an incident or malfunctioning of an AI system that directly or indirectly leads to: (a) death or serious harm to a person’s health; (b) serious and irreversible disruption of the management or operation of critical infrastructure; (c) infringement of Union-law obligations intended to protect fundamental rights; or (d) serious harm to property or the environment.
Reporting duties
- Providers of high-risk systems must report to the market surveillance authority of the Member State where the incident occurred: as a rule within 15 days of awareness, faster for the gravest cases (72 hours for widespread infringement or critical-infrastructure disruption);
- Deployers must inform the provider without delay: contracts should wire this handoff;
- GPAI models with systemic risk carry parallel incident-tracking duties under Article 55.
Why it matters
Incident response is where AI compliance meets operations: logging (your evidence), post-market monitoring (your detection), and KVKK breach notification can all fire from one event. Build the playbook before the incident: see our AI incident response guide.
Working on this? Vircon Legal advises on AI & Algorithm Law and AI Compliance Hub. Talk to us →
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call