Article 73: reporting serious incidents
When a high-risk system goes seriously wrong, the Act expects a fast, orderly response rather than silence. Article 73 sets out the reporting.
What counts as a serious incident
An incident or malfunction that leads, or could lead, to death or serious harm to a person's health, a serious and irreversible disruption of critical infrastructure, a breach of obligations meant to protect fundamental rights, or serious harm to property or the environment.
Everyday glitches are not this. It is the genuinely serious outcomes the duty is about.
The deployer's part
Reporting sits mainly with the provider, but you have a clear part to play. If you become aware of a serious incident, inform the provider, and where needed the importer or distributor and the relevant authority, and suspend use where that is the safe call.
You are not expected to run the full investigation, but you are expected to raise the alarm promptly rather than carry on as if nothing happened.
Move quickly
The Act sets tight deadlines, measured in a small number of days from when you become aware, with the shortest windows for the most severe cases such as a death or a widespread failure. Because the exact windows depend on the severity, confirm them for your situation rather than relying on a single number.
The practical takeaway is speed. A serious incident is not something to sit on while you decide what to do, and the clock generally starts when you become aware, which is exactly why a prepared plan matters.
Have a plan before you need it
The real value is agreeing the path in advance: who decides to suspend use, who contacts the provider, and who reports to the authority. Improvising during an incident is how deadlines get missed and decisions get second-guessed.
A single page that names those people and steps, kept where the right people can find it, is worth far more than good intentions on the day.
Documenting it
An Incident Response Procedure records the steps, the contacts, and the timelines, so the path is clear before anything goes wrong. It is the difference between a calm, ordered response and a panicked one.
Veillo generates one per high-risk system as a structured starting point, which you adapt to name your real contacts and escalation path.
This guide is general educational information, not legal advice. For how the Act applies to your organisation, classify your systems and consult qualified counsel.
Put it into practice
Classify your AI systems against the Act and generate the documents this guide describes.