Post-market monitoring and serious incidents

The EU AI Act (Regulation (EU) 2024/1689) has these rules for high-risk AI systems after their placing on the market or putting into service:

• Article 72 — the provider's post-market monitoring system and plan.
• Article 73 — the provider's report of a serious incident.
• Article 26(5) and (6) — the deployer's monitoring, notification and log duties.
• Article 20 — the provider's corrective actions.

Scope and dates

The EU AI Act gives the duties on this page to providers and deployers of high-risk AI systems in the scope of Article 2. Article 2 has different tests for each actor. For the scope rules, see Article 2 — scope.

Article 2(2) excludes Articles 20, 26, 72 and 73 for Article 6(1) high-risk systems related to Annex I Section B products.

Articles 72 and 73 apply from 2 August 2026, while Articles 20 and 26 have different Annex III and Annex I application dates.

Article 111 gives different transitions for Annex X components, other older high-risk systems and systems intended for public-authority use, without prejudice to Article 5.

On 26 September 2025, the Commission published a draft guidance and a draft reporting template for Article 73 for consultation. The Commission page tells providers that these documents help them to prepare. For their status, see Guidance status.

Article 3(49) — serious incident

The EU AI Act defines a serious incident in Article 3(49):

‘serious incident’ means an incident or malfunctioning of an AI system that directly or indirectly leads to any of the following:

(a) the death of a person, or serious harm to a person’s health;

(b) a serious and irreversible disruption of the management or operation of critical infrastructure;

(c) the infringement of obligations under Union law intended to protect fundamental rights;

(d) serious harm to property or the environment;

One of the four results is sufficient. The incident or malfunctioning can cause the result directly or indirectly. Point (c) is about the infringement of an obligation in Union law that is “intended to protect fundamental rights”. An incident or malfunctioning that causes none of the four results is not a serious incident in Article 3(49).

Article 72 — post-market monitoring system

Article 72 of the EU AI Act applies to providers of high-risk AI systems. Article 3(25) defines the post-market monitoring system:

‘post-market monitoring system’ means all activities carried out by providers of AI systems to collect and review experience gained from the use of AI systems they place on the market or put into service for the purpose of identifying any need to immediately apply any necessary corrective or preventive actions;

Article 72(1) and (2) give the duty:

Providers shall establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system.

The post-market monitoring system shall actively and systematically collect, document and analyse relevant data which may be provided by deployers or which may be collected through other sources on the performance of high-risk AI systems throughout their lifetime, and which allow the provider to evaluate the continuous compliance of AI systems with the requirements set out in Chapter III, Section 2. Where relevant, post-market monitoring shall include an analysis of the interaction with other AI systems. This obligation shall not cover sensitive operational data of deployers which are law-enforcement authorities.

Article 72 does not prescribe real-time monitoring of each metric.

The data can come from deployers or other sources. Article 72(2) does not make one source mandatory. Chapter III, Section 2 contains Articles 8 to 15.

Other provisions of the EU AI Act use the data. The risk management system of Article 9 evaluates other risks that can occur, from the analysis of post-market monitoring data (Article 9(2)(c)). The quality management system of Article 17 includes the post-market monitoring system and the procedures for serious-incident reports (Article 17(1)(h) and (i)). For these provisions, see Articles 8–15 — provider obligations and Article 17 — quality-management system (QMS).

Article 72(3) — the post-market monitoring plan

The post-market monitoring system shall be based on a post-market monitoring plan. The post-market monitoring plan shall be part of the technical documentation referred to in Annex IV. The Commission, taking utmost account of the opinion of the Board, shall adopt guidance, including a template, on the post-market monitoring plan by 2 September 2027.

Regulation (EU) 2026/1744 gave Article 72(3) this text (Article 1, point (30)). Before that change, Article 72(3) told the Commission to adopt an implementing act with a template for the plan by 2 February 2026.

The technical documentation includes, in Annex IV, point 9, “a detailed description of the system in place to evaluate the AI system performance in the post-market phase in accordance with Article 72, including the post-market monitoring plan referred to in Article 72(3)”. Annex IV does not give the elements of the plan. The provider prepares the technical documentation before the placing on the market or putting into service of the system (Article 11(1)). It keeps the documentation up to date.

Article 72(4) — sectoral monitoring systems

Article 72(4) of the EU AI Act gives providers an alternative for two groups of high-risk AI systems:

• Systems covered by the Union harmonization legislation in Annex I, Section A, where a post-market monitoring system and plan are “already established under that legislation”.
• Systems in Annex III, point 5, that financial institutions place on the market or put into service. The institutions must be subject to requirements in Union financial services law on their internal governance, arrangements or processes.

For these systems, the provider can integrate the necessary elements of Article 72(1) to (3), “as appropriate”, into the systems and plans of the applicable legislation. The integration uses the template of Article 72(3). The condition is that the integration “achieves an equivalent level of protection”. Article 72(4) gives an alternative to integrate. It does not make compliance with financial services law equal to compliance with Article 72.

Article 26 — deployer monitoring

Article 26(5) of the EU AI Act gives deployers of high-risk AI systems these duties:

• Monitoring — deployers must monitor the operation of the high-risk AI system on the basis of the instructions for use. Where “relevant”, they must inform providers in accordance with Article 72.
• Risk — this duty applies when deployers “have reason to consider” that use in accordance with the instructions “may result in that AI system presenting a risk within the meaning of Article 79(1)”. Article 79(1) is about risks to the health or safety, or to the fundamental rights, of persons. Then deployers must inform the provider or distributor and the “relevant” market surveillance authority “without undue delay”. They must also “suspend the use of that system”.
• Serious incident — when deployers identify a serious incident, they must also immediately inform first the provider, and then the importer or distributor and the “relevant” market surveillance authorities.
• Provider not available — “If the deployer is not able to reach the provider, Article 73 shall apply mutatis mutandis.” This means that Article 73 applies to the deployer with the necessary changes for that role.
• Limit — “This obligation shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities.”
• Financial institutions — some deployers are financial institutions subject to requirements on their internal governance, arrangements or processes in Union financial services law. For these deployers, the monitoring obligation is “deemed to be fulfilled” by compliance with the rules of that law on internal governance arrangements, processes and mechanisms.

Article 26(6) of the EU AI Act gives deployers of high-risk AI systems these log duties:

• Deployers must keep the logs that the system generates automatically and that they control.
• The period must be “appropriate to the intended purpose” of the system, with a minimum of six months. Applicable Union or national law can give a different rule, “in particular in Union law on the protection of personal data”.
• Deployers that are financial institutions, as above, keep the logs as part of the documentation of the applicable Union financial services law.

Deployers have other duties in Article 26, for example the use of the system in accordance with the instructions for use and human oversight. See Article 26 — deployer obligations on high-risk AI systems.

Article 73 — serious-incident reporting

Article 73 of the EU AI Act tells providers of high-risk AI systems placed on the Union market to report serious incidents. If a deployer “is not able to reach the provider”, Article 73 applies to the deployer with the necessary changes for that role (Article 26). Article 73 does not apply to the Section B systems in Scope and dates.

Article 73(1) — reporting recipients

Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.

The recipient of the report depends on the system:

• Market surveillance authorities — the market surveillance authorities of the Member States where the incident occurred (Article 73(1)).
• AI Office — Article 75(1a) is a derogation from Article 73. Providers of high-risk AI systems in the exclusive competence of the AI Office report serious incidents to the AI Office. Article 73(2) to (9) apply with the necessary changes for reporting to the AI Office. The AI Office sends the information promptly to the market surveillance authority of the Member State where the provider or its legal representative is.
• Medical devices — for systems covered by Regulations (EU) 2017/745 and (EU) 2017/746, the national competent authority in Article 73(10). See Article 73(7)–(11).

Article 75(1) limits the AI Office's exclusive competence by system and actor (see Penalties and enforcement).

Article 73(2)–(4) — reporting times

Article 73(2) to (4) of the EU AI Act give the times for the report:

Incident	The report is due	Latest time	Provision
Serious incident, other than the two rows below	“immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link”	“not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident”	Article 73(2)
Widespread infringement (Article 3(61)), or a serious incident in Article 3(49)(b)	“immediately”	“not later than two days after the provider or, where applicable, the deployer becomes aware of that incident”	Article 73(3)
Death of a person	“immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident”	“not later than 10 days after the date on which the provider or, where applicable, the deployer becomes aware of the serious incident”	Article 73(4)

The latest time is not a period to wait. The report is due immediately, and the latest time is the limit in all cases. Article 73(3) and (4) apply “notwithstanding paragraph 2”. Article 73(2) also tells providers that the reporting period “shall take account of the severity of the serious incident”.

Article 73(5)–(6) — initial reports and investigations

Article 73(5) and (6) of the EU AI Act have these rules after a serious incident:

• Initial report — “Where necessary to ensure timely reporting, the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report.”
• Investigation — after the report, the provider must do the necessary investigations about the serious incident and the AI system “without delay”. The investigations include a risk assessment of the incident and corrective action.
• Cooperation — during the investigations, the provider must cooperate with the competent authorities and, where “relevant”, with the notified body.
• Inform authorities before specified changes — the provider “shall not perform any investigation which involves altering the AI system concerned in a way which may affect any subsequent evaluation of the causes of the incident, prior to informing the competent authorities of such action”.

Article 73(7)–(11) — authority obligations and reporting limits

Article 73(7) to (11) of the EU AI Act have these rules for authorities and for limits on reports:

• Article 73(7) — this rule is for a notification of a serious incident in Article 3(49)(c). The “relevant” market surveillance authority that receives it must inform the national public authorities or bodies in Article 77(1). These bodies “supervise or enforce the respect of obligations under Union law protecting fundamental rights”. Article 73(7) also tells the Commission to “develop dedicated guidance” for the obligations in Article 73(1). That guidance “shall be issued by 2 August 2025, and shall be assessed regularly”.
• Article 73(8) — the market surveillance authority must “take appropriate measures, as provided for in Article 19 of Regulation (EU) 2019/1020, within seven days from the date it received the notification”. It must follow the notification procedures of that Regulation.
• Article 73(9) — this rule is for high-risk AI systems in Annex III that providers place on the market or put into service. The providers must be subject to Union legislative instruments with reporting obligations equivalent to those of the EU AI Act. For these systems, the notification includes only serious incidents in Article 3(49)(c).
• Article 73(10) — this rule is for high-risk AI systems that are safety components of devices, or are devices, covered by Regulations (EU) 2017/745 and (EU) 2017/746. Providers of these systems also notify only serious incidents in Article 3(49)(c). The notification goes to the national competent authority that the Member States where the incident occurred chose for that purpose.
• Article 73(11) — national competent authorities must immediately notify the Commission of each serious incident, “whether or not they have taken action on it”, in accordance with Article 20 of Regulation (EU) 2019/1020.

Article 55(1)(c) — general-purpose AI models with systemic risk

Providers of general-purpose AI models with systemic risk have a different Article 55(1)(c) reporting duty, which can apply alongside Article 73.

Other reporting duties

Other Union law can also apply to a serious incident in the EU AI Act. The EU AI Act “shall not affect” the data protection acts listed in Article 2(7), for example Regulation (EU) 2016/679. This rule is without prejudice to Articles 4a and 59.

Paragraph (64) of the draft Article 73 guidance identifies possible overlaps with these reporting duties:

• Article 33 of Regulation (EU) 2016/679, for a personal data breach.
• Article 23 of the NIS 2 Directive.
• The Cyber Resilience Act.

In the draft, the Commission “will at a later point specify the interplay”.

Articles 74(8) and (9) give special market surveillance arrangements for specified Annex III systems and Union institutions.

Article 20 — corrective actions

Article 20 of the EU AI Act gives providers of high-risk AI systems these duties:

• Non-conformity — providers can “consider or have reason to consider” that a high-risk AI system that they placed on the market or put into service is not in conformity with the EU AI Act. Then they must immediately “take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it, or to recall it, as appropriate”. They must inform the distributors of the system and, where applicable, the deployers, the authorized representative and importers (Article 20(1)).
• Risk — “Where the high-risk AI system presents a risk within the meaning of Article 79(1) and the provider becomes aware of that risk”, the provider must “immediately investigate the causes, in collaboration with the reporting deployer, where applicable”. The provider must immediately inform the market surveillance authorities competent for the system. Where applicable, it must also immediately inform the notified body that issued a certificate for the system in accordance with Article 44. The information is “in particular” about the nature of the non-compliance and of each “relevant” corrective action (Article 20(2)).

Distributors have their own corrective-action duties in Article 24(4). See Article 24 — distributor obligations.

Modulos

Modulos allocates the EU AI Act to two Frameworks: OFF-1 for the Organization and MFF-1 for each AI System.

Modulos recommends that providers prepare the monitoring plan in the technical documentation before conformity assessment.

For the mapping, see Requirements and provisions.

Related information

• EU AI Act questions
• High-risk AI systems
• Conformity assessment and CE marking
• Roles and responsibilities
• General-purpose AI models
• EU AI Act and GDPR
• Compare frameworks

Sources

• EU AI Act (Regulation (EU) 2024/1689 of 13 June 2024), consolidated text of 27 July 2026: EUR-Lex.
  • Articles 2(2), 2(7), 3(25), 3(49), 3(61), 9(2)(c), 11(1), and 17(1)(h)–(i).
  • Articles 20, 24(4), 26(5)–(6), and 55(1)(c).
  • Articles 72, 73, 74(8)–(9), 75(1)–(1a), 77(1), 79(1), 111(1)–(2), and 113.
  • Annex IV, point 9.
• EU AI Act, initial text: Regulation (EU) 2024/1689 as published in the Official Journal on 12 July 2024. Article 72(3). EUR-Lex.
• Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026), OJ L, 24.7.2026: Article 1, point (30), which replaces Article 72(3). EUR-Lex.
• Draft Article 73 guidance: Commission page “AI Act: Commission issues draft guidance and reporting template on serious AI incidents, and seeks stakeholders' feedback”, 26 September 2025. Commission page.
  • “Draft Guidance Article 73 AI Act - Incident Reporting (High-risk AI Systems)”, paragraph (64). Commission text.
  • Draft reporting template. Commission text.

Disclaimer

This page gives general information. It is not legal advice.