Builds on AR-000240 (Provider Obligations) and AR-000370 (Post-Market Monitoring) — none of their content is re-derived here. Article 73 is the reporting obligation that activates when post-market monitoring or deployer feedback identifies a serious incident as defined in Article 3(49) (AR-000340).
Executive summary
The three reporting timelines
What this means
Who this applies to
Regulatory context
The investigation obligation after reporting
The narrowed reporting scope for certain system categories
Commission guidance
Requirements
What organizations must do
- Build an internal serious-incident triage process that can assess Article 3(49) classification and determine the applicable timeline within hours of becoming aware of an incident — the 2-day timeline for critical infrastructure and widespread infringement incidents leaves little room for deliberation.
- Report immediately on the applicable timeline even if the investigation is incomplete — Article 73(5) allows an initial incomplete report followed by a full report.
- After reporting, begin investigation, risk assessment, and corrective action without delay — and notify competent authorities before making any system changes that could affect the investigation.
- Establish a deployer feedback channel that surfaces serious incidents to the provider quickly — the reporting clock can start at deployer awareness, so deployer-to-provider notification speed affects provider compliance.
- For medical device / IVD AI systems and systems with equivalent sectoral reporting: confirm which Article 3(49) categories still require Article 73 reporting (only (c)) and confirm the correct national authority to report to.
Common mistakes
Waiting for investigation results before reporting is a common mistake — the reporting obligation activates at reasonable likelihood of a causal link, not at confirmed causation, and Article 73(5) explicitly accommodates incomplete initial reports.
Applying the 15-day timeline to all incidents is a second mistake — critical infrastructure disruption and widespread infringement incidents have a 2-day timeline; deaths have a 10-day timeline with an immediate reporting obligation on suspicion.
Applying corrective patches or system changes before notifying competent authorities is a third mistake — Article 73(6) prohibits changes affecting investigation evaluation without prior notification, even when Article 20 requires corrective action.
Treating deployer incident reports as the sole input to the Article 73 awareness clock is a fourth mistake — providers should also have independent monitoring through the Article 72 post-market monitoring system, which may identify serious incidents before deployers report them.
Open questions
- Whether the Commission issued the Article 73(7) compliance guidance by the 2 August 2025 deadline — not confirmed against a primary source on this research pass.
- How “widespread infringement” under Article 3(61) is assessed in practice for the 2-day timeline — Article 3(61) provides the definition (harm to collective interests in at least two Member States, or same conduct by same operator in at least three Member States), but the evidentiary standard for triggering the accelerated timeline is not elaborated in Article 73.
- Whether Article 73 has been amended by the Digital Omnibus — no disclaimer found on the Service Desk as of this verification pass; treated as clean pre-amendment text, not as confirmed unamended.