Serious Incident Reporting

The continuous, systematic process by which a provider collects and analyzes real-world data on a deployed AI system's performance. This is the proactive surveillance mechanism that feeds the serious incident reporting obligation.

• Identifies emerging risks not caught in pre-market testing
• Analyzes usage data, user feedback, and publicly available information
• Triggers the reporting clock when a serious incident is detected
• Required for all high-risk AI systems under the EU AI Act

A risk classification for general-purpose AI models possessing high-impact capabilities that could cause large-scale harm. When a model with systemic risk designation malfunctions, the incident reporting threshold is exceptionally low.

• Applies to GPAI models trained with cumulative compute exceeding 10^25 FLOPs
• Triggers mandatory adversarial testing and model evaluation
• Requires immediate notification of serious incidents to the AI Office
• Covers both direct harm and reasonably foreseeable misuse

A national public body designated by an EU member state to enforce the AI Act. This is the primary recipient of serious incident reports and the entity with the power to investigate and compel corrective action.

• Possesses investigative powers including unannounced on-site inspections
• Can demand immediate withdrawal or recall of non-compliant systems
• Coordinates cross-border incidents through the European AI Board
• Must be notified immediately, no later than 15 days after the incident is established

The structured protocols for managing AI system failures, encompassing detection, containment, eradication, and recovery. Serious incident reporting is the external-facing regulatory component of a broader internal incident response framework.

• Includes model rollback to a previously validated safe state
• Requires forensic analysis to determine root cause and prevent recurrence
• Mandates decommissioning procedures if the risk cannot be mitigated
• Integrates with existing Site Reliability Engineering incident management workflows

The immutable recording of AI-driven decisions and their inputs for auditability. These logs are the evidentiary backbone of any serious incident investigation, providing the forensic trail needed to reconstruct the failure.

• Captures input data, model version, inference timestamp, and output
• Enables deterministic replay of the decision path that led to harm
• Supports the legal right to explanation for affected individuals
• Must be cryptographically verifiable to ensure non-repudiation

A change to an AI system's intended purpose or a significant alteration to its performance characteristics. If a serious incident is caused by an undeclared substantial modification, the provider faces heightened liability and the original CE marking is invalidated.

• Triggers a new conformity assessment requirement
• Includes changes to the algorithmic logic, training data distribution, or operational domain
• Continuous learning systems that drift beyond their certified envelope may be considered substantially modified
• The reporting obligation falls on the entity that performed the modification