What is a serious incident under the AI Act?
A serious incident (Article 3(49)) is an incident or malfunctioning of an AI system that directly or indirectly leads to: (a) death or serious harm to a person’s health; (b) serious and irreversible disruption of the management or operation of critical infrastructure; (c) infringement of Union-law obligations intended to protect fundamental rights; or (d) serious harm to property or the environment.
Reporting duties
- Providers of high-risk systems must report to the market surveillance authority of the Member State where the incident occurred — as a rule within 15 days of awareness, faster for the gravest cases (72 hours for widespread infringement or critical-infrastructure disruption);
- Deployers must inform the provider without delay — contracts should wire this handoff;
- GPAI models with systemic risk carry parallel incident-tracking duties under Article 55.
Why it matters
Incident response is where AI compliance meets operations: logging (your evidence), post-market monitoring (your detection), and KVKK breach notification can all fire from one event. Build the playbook before the incident — see our AI incident response guide.