Direct answer
Do we have to report serious incidents with our AI system?
This falls under Article 73: serious incident reporting. That obligation applies from 2 December 2027. There is one exception you have to assess yourself.
This could go the other way
- For systems under sectoral reporting regimes with equivalent duties, reporting may run through that regime to avoid duplication.
First step: Set up an incident process with reporting routes.
You describe: Something goes wrong with a high-risk AI system and you need to know whether that is a reportable incident, who to report it to and within what deadline. Likely role: provider (you place the system on the market).
This applies now
- For this situation, the preparation phase matters most right now.
Coming up
- Article 73: serious incident reportingfrom 2 December 2027
- Article 72: post-market monitoringfrom 2 December 2027
- Article 12: logging and traceabilityfrom 2 December 2027
The deadline depends on severity: at most 15 days after establishing the causal link, 10 days in case of death and 2 days for a widespread infringement or serious disruption of critical infrastructure. As a deployer you do not report to the authority yourself but inform the provider without delay.
Your first actions
- Set up an incident process with reporting routes. Define what a serious incident is, assign the reporting route to the supervisor and rehearse the process.
- Draw up a post-market monitoring plan. Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.
- Design logging into the system. Ensure the system automatically records events relevant to risk identification and post-market monitoring.
Record this
- Incident register and reports
- Monitoring plan and reports
- Logs and retention regime
prEN 18229-1: AI trustworthiness framework part 1, logging
prEN 18229-1 (AI trustworthiness framework, Part 1: Logging) is the JTC 21 deliverable under M/613 for Article 12 of the AI Act: high-risk AI systems must technically allow for the automatic recording of events over their lifetime. As at June 2026 the deliverable was at the Enquiry stage. It has not yet been published as an EN and is not cited in the Official Journal.
General interpretation, not legal advice. Checked against Regulation (EU) 2024/1689 and the Digital Omnibus (EU) 2026/1744; the official source remains authoritative.
Full map for your situationFollow-up questions
Execution
From obligation to arranged and demonstrable
Knowing where you stand is step one. Embed AI translates this obligation into a concrete approach for your organisation: scope, ownership, register and evidence.
See the Embed AI approach