# AI Incident Notification — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/serious-incident-notification-ai > Sources are cited per item. Verify against the official texts before relying on them. The AI Act establishes specific procedures for notifying authorities about serious incidents and anomalies in high-risk AI systems, which requires dedicated coverage distinct from general information duties and incident reporting. ## Overview ## AI Incident Notification ## Legal Framework The AI Act establishes a structured incident notification regime for high-risk AI systems, primarily governed by Article 73, which obliges providers to notify the relevant market surveillance authority without undue delay — and in any event within 15 days of becoming aware — of serious incidents involving their AI systems. A "serious incident" is defined as any incident or malfunctioning of an AI system that has led or may lead to death or serious harm to a person's health, a serious and irreversible disruption of critical infrastructure, or a breach of fundamental rights protected under Union law. Article 85 complements this by granting any natural or legal person the right to lodge complaints with the relevant market surveillance authority where they have grounds to consider that an infringement of the Regulation has occurred. Recital 170 confirms that this complaint mechanism operates without prejudice to existing remedies under Union and national law. Recital 36 imposes additional, sector-specific notification obligations for real-time biometric identification systems, requiring that both the market surveillance authority and the national data protection authority be notified of each use. These authorities must then submit annual reports to the Commission. The rationale is twofold: first, to ensure that authorities can act swiftly when AI systems cause or risk causing serious harm; second, to create a feedback loop that informs future regulatory and supervisory action. ## Key Developments The AI Act's incident notification regime draws conceptual parallels with the GDPR's personal data breach notification framework under Article 33 GDPR, but extends the scope beyond data protection harms to encompass physical safety, infrastructure disruption, and fundamental rights violations. Enforcement practice under Article 33 GDPR — particularly decisions by the Irish DPC and CNIL — has established that the "undue delay" standard typically requires notification within 72 hours, and that organizations must document the rationale for any delayed notification. While the AI Act's 15-day window is more generous, the same principle of demonstrating diligence applies. The interplay between AI Act incident notification and GDPR breach notification obligations creates a dual-reporting scenario where an AI system malfunction involving personal data may trigger both regimes simultaneously. Providers must assess whether an incident meets both thresholds and coordinate notifications to both market surveillance authorities and data protection authorities. ## Practical Guidance - **Establish internal incident classification criteria** that map to the Article 73 definition of "serious incident," distinguishing between incidents requiring notification and those that fall below the threshold — document the reasoning for each determination. - **Implement a 15-day notification clock** triggered from the moment any personnel become aware of a potential serious incident, not from the conclusion of an internal investigation; build in buffer time for assessment and drafting. - **Designate a single accountable role** responsible for coordinating notifications to market surveillance authorities, data protection authorities (where GDPR obligations are triggered), and, for biometric systems, the dual-notification pathway required by Recital 36. - **Prepare notification templates in advance** covering the required content: incident description, AI system identifier, nature of harm, corrective measures taken, and cross-references to the system's technical documentation and risk management records under Article 9. - **Maintain an incident register** that captures all incidents regardless of whether they met the notification threshold, as this record may be requested during market surveillance audits and will support the annual reporting obligations applicable to biometric identification system deployments. ## Legislation (full text of key provisions) ### Right to lodge a complaint with a market surveillance authority *Source: AI Act, aiact-art-85-en, 2024-06-12 — https://overview.legal/posts/93389* Without prejudice to other administrative or judicial remedies, any natural or legal person having grounds to consider that there has been an infringement of the provisions of this Regulation may submit complaints to the relevant market surveillance authority.In accordance with Regulation (EU) 2019/1020, such complaints shall be taken into account for the purpose of conducting market surveillance activities, and shall be handled in line with the dedicated procedures established therefor by the market surveillance authorities. ### Recital 170 — complaint rights for AI regulation infringement *Source: AI Act, aiact-rec-170-en, 2024-06-12 — https://overview.legal/posts/94022* Union and national law already provide effective remedies to natural and legal persons whose rights and freedoms are adversely affected by the use of AI systems. Without prejudice to those remedies, any natural or legal person that has grounds to consider that there has been an infringement of this Regulation should be entitled to lodge a complaint to the relevant market surveillance authority. ### Recital 141 — real world testing conditions without sandbox *Source: AI Act, aiact-rec-141-en, 2024-06-12 — https://overview.legal/posts/93964* In order to accelerate the process of development and the placing on the market of the high-risk AI systems listed in an annex to this Regulation, it is important that providers or prospective providers of such systems may also benefit from a specific regime for testing those systems in real world conditions, without participating in an AI regulatory sandbox. However, in such cases, taking into account the possible consequences of such testing on individuals, it should be ensured that appropriate and sufficient guarantees and conditions are introduced by this Regulation for providers or prospective providers. Such guarantees should include, inter alia, requesting informed consent of natural persons to participate in testing in real world conditions, with the exception of law enforcement where the seeking of informed consent would prevent the AI system from being tested. Consent of subjects to participate in such testing under this Regulation is distinct from, and without prejudice to, consent of data subjects for the processing of their personal data under the relevant data protection law. It is also important to minimise the risks and enable oversight by competent authorities and therefore require prospective providers to have a real-world testing plan submitted to competent market surveillance authority, register the testing in dedicated sections in the EU database subject to some limited exceptions, set limitations on the period for which the testing can be done and require additional safeguards for persons belonging to certain vulnerable groups, as well as a written agreement defining the roles and responsibilities of prospective providers and deployers and effective oversight by competent personnel involved in the real world testing. Furthermore, it is appropriate to envisage additional safeguards to ensure that the predictions, recommendations or decisions of the AI system can be effectively reversed and disregarded and that personal data is protected and is deleted when the subjects have withdrawn their consent to participate in the testing without prejudice to their rights as data subjects under the Union data protection law. As regards transfer of data, it is also appropriate to envisage that data collected and processed for the purpose of testing in real-world conditions should be transferred to third countries only where appropriate and applicable safeguards under Union law are implemented, in particular in accordance with bases for transfer of personal data under Union law on data protection, while for non-personal data appropriate safeguards are put in place in accordance with Union law, such as Regulations (EU) 2022/868 (42) and (EU) 2023/2854 (43) of the European Parliament and of the Council. ### Recital 156 — market surveillance and compliance enforcement framework *Source: AI Act, aiact-rec-156-en, 2024-06-12 — https://overview.legal/posts/93994* In order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this Regulation, which is Union harmonisation legislation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply in its entirety. Market surveillance authorities designated pursuant to this Regulation should have all enforcement powers laid down in this Regulation and in Regulation (EU) 2019/1020 and should exercise their powers and carry out their duties independently, impartially and without bias. Although the majority of AI systems are not subject to specific requirements and obligations under this Regulation, market surveillance authorities may take measures in relation to all AI systems when they present a risk in accordance with this Regulation. Due to the specific nature of Union institutions, agencies and bodies falling within the scope of this Regulation, it is appropriate to designate the European Data Protection Supervisor as a competent market surveillance authority for them. This should be without prejudice to the designation of national competent authorities by the Member States. Market surveillance activities should not affect the ability of the supervised entities to carry out their tasks independently, when such independence is required by Union law. ### Recital 159 — biometric AI surveillance authority powers *Source: AI Act, aiact-rec-159-en, 2024-06-12 — https://overview.legal/posts/94000* Each market surveillance authority for high-risk AI systems in the area of biometrics, as listed in an annex to this Regulation insofar as those systems are used for the purposes of law enforcement, migration, asylum and border control management, or the administration of justice and democratic processes, should have effective investigative and corrective powers, including at least the power to obtain access to all personal data that are being processed and to all information necessary for the performance of its tasks. The market surveillance authorities should be able to exercise their powers by acting with complete independence. Any limitations of their access to sensitive operational data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation. ### Recital 161 — Union and national supervision responsibilities for general-purpose AI *Source: AI Act, aiact-rec-161-en, 2024-06-12 — https://overview.legal/posts/94004* It is necessary to clarify the responsibilities and competences at Union and national level as regards AI systems that are built on general-purpose AI models. To avoid overlapping competences, where an AI system is based on a general-purpose AI model and the model and system are provided by the same provider, the supervision should take place at Union level through the AI Office, which should have the powers of a market surveillance authority within the meaning of Regulation (EU) 2019/1020 for this purpose. In all other cases, national market surveillance authorities remain responsible for the supervision of AI systems. However, for general-purpose AI systems that can be used directly by deployers for at least one purpose that is classified as high-risk, market surveillance authorities should cooperate with the AI Office to carry out evaluations of compliance and inform the Board and other market surveillance authorities accordingly. Furthermore, market surveillance authorities should be able to request assistance from the AI Office where the market surveillance authority is unable to conclude an investigation on a high-risk AI system because of its inability to access certain information related to the general-purpose AI model on which the high-risk AI system is built. In such cases, the procedure regarding mutual assistance in cross-border cases in Chapter VI of Regulation (EU) 2019/1020 should apply mutatis mutandis. ### Recital 153 — national competent authorities designation *Source: AI Act, aiact-rec-153-en, 2024-06-12 — https://overview.legal/posts/93988* Member States hold a key role in the application and enforcement of this Regulation. In that respect, each Member State should designate at least one notifying authority and at least one market surveillance authority as national competent authorities for the purpose of supervising the application and implementation of this Regulation. Member States may decide to appoint any kind of public entity to perform the tasks of the national competent authorities within the meaning of this Regulation, in accordance with their specific national organisational characteristics and needs. In order to increase organisation efficiency on the side of Member States and to set a single point of contact vis-à-vis the public and other counterparts at Member State and Union levels, each Member State should designate a market surveillance authority to act as a single point of contact. ### Recital 36 — biometric system use notification and reporting *Source: AI Act, aiact-rec-36-en, 2024-06-12 — https://overview.legal/posts/93754* In order to carry out their tasks in accordance with the requirements set out in this Regulation as well as in national rules, the relevant market surveillance authority and the national data protection authority should be notified of each use of the real-time biometric identification system. Market surveillance authorities and the national data protection authorities that have been notified should submit to the Commission an annual report on the use of real-time biometric identification systems. ### Recital 115 — systemic risk management for general-purpose AI *Source: AI Act, aiact-rec-115-en, 2024-06-12 — https://overview.legal/posts/93912* Providers of general-purpose AI models with systemic risks should assess and mitigate possible systemic risks. If, despite efforts to identify and prevent risks related to a general-purpose AI model that may present systemic risks, the development or use of the model causes a serious incident, the general-purpose AI model provider should without undue delay keep track of the incident and report any relevant information and possible corrective measures to the Commission and national competent authorities. Furthermore, providers should ensure an adequate level of cybersecurity protection for the model and its physical infrastructure, if appropriate, along the entire model lifecycle. Cybersecurity protection related to systemic risks associated with malicious use or attacks should duly consider accidental model leakage, unauthorised releases, circumvention of safety measures, and defence against cyberattacks, unauthorised access or model theft. That protection could be facilitated by securing model weights, algorithms, servers, and data sets, such as through operational security measures for information security, specific cybersecurity policies, adequate technical and established solutions, and cyber and physical access controls, appropriate to the relevant circumstances and the risks involved. ### Recital 130 — rapid deployment of innovative AI systems *Source: AI Act, aiact-rec-130-en, 2024-06-12 — https://overview.legal/posts/93942* Under certain conditions, rapid availability of innovative technologies may be crucial for health and safety of persons, the protection of the environment and climate change and for society as a whole. It is thus appropriate that under exceptional reasons of public security or protection of life and health of natural persons, environmental protection and the protection of key industrial and infrastructural assets, market surveillance authorities could authorise the placing on the market or the putting into service of AI systems which have not undergone a conformity assessment. In duly justified situations, as provided for in this Regulation, law enforcement authorities or civil protection authorities may put a specific high-risk AI system into service without the authorisation of the market surveillance authority, provided that such authorisation is requested during or after the use without undue delay. ## Guidance ### Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework *Source: EDPB, statement-32024-on-data-protection-authorities-role-in-the-en, 2024-07-16 — https://overview.legal/posts/125732 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/statement-32024-on-data-protection-authorities-role-in-the_en* Final 1 Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework Adopted on 16 July 2024 The European Data Protection Board has adopted the following statement: 1 BACKGROUND AND PURPO SE OF THIS STATEMENT 1. On 12 July 2024, Regulation (EU) 2024/1689 laying down harmonised rules on a rtificial i ntelligence (Artificial Intelligence Act, hereinafter the “ AI Act ”) and amending certain Union Legislative Acts was published in the Official Journal 1 . 2.… ### EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space *Source: EDPB, edpb-edps-joint-opinion-032022-on-the-proposal-for-a-regulation-on-en, 2022-07-12 — https://overview.legal/posts/125922 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-032022-on-the-proposal-for-a-regulation-on_en* Adopted 1 EDPB - EDPS Joint Opinion 03 /2022 on the Proposal for a Regulation on the European Health Data Space Adopted on 12 July 2022 Adopted 2 Adopted 3 Executive Summary With this Joint Opinion, the EDPB and the EDPS aim to draw attention to a number of overarching concerns on the Proposal on the European Health Data Space and urge the co - legislature to take decisive action. The EDPB and the EDPS note that the Proposal ai ms at supporting individuals to take control of their own health… ## Literature ### Use of Artificial Intelligence Tools by Law Enforcement Services in Light of the Artificial Intelligence Act *Source: Zeszyt Prawniczy UAM, 2025-12-22 — https://overview.legal/posts/132565 — original: https://doi.org/10.14746/zpuam.2025.15.4* Celem artykułu jest wskazanie przestępstw, w przypadku których służby państwowe mogą korzystać z systemów zdalnej identyfikacji biometrycznej w czasie rzeczywistym w przestrzeni publicznej. Zostanie to uczynione przez analizę przesłanek umożliwiających posługiwanie się tą technologią oraz przyrównanie ich do czynów zabronionych przez polski kodeks karny. Rezultatem powyższego jest stworzenie katalogu przestępstw, odnośnie do których służby mogą zastosować system zdalnej identyfikacji biometryczn ## Related topics - **Post-Market Monitoring for AI Systems** — https://overview.legal/topics/post-market-monitoring-ai Risk management systems require ongoing post-market monitoring to identify and respond to risks that emerge during real-world deployment. This is a distinct and - **Monitoring** — https://overview.legal/topics/monitoring Systematic observation and tracking of individuals - **Authority Access Rights to AI Systems and Documentation** — https://overview.legal/topics/authority-access-rights-ai-systems This new topic would specifically address the rights and procedures for competent authorities to access AI systems, facilities, documentation, and data during o - **Market Surveillance and Control of AI Systems** — https://overview.legal/topics/market-surveillance-control-ai This new topic is needed to comprehensively cover the specific procedures, mechanisms, and authorities involved in market surveillance and control of AI systems - **Interim Measures under AI Act** — https://overview.legal/topics/interim-measures-ai-act This new topic is needed to specifically address interim measures provisions in the AI Act, which allow authorities to take temporary protective actions against - **Conformity Body Notification** — https://overview.legal/topics/conformity-assessment-body-notification This new topic is needed because the content specifically addresses the application and notification procedures for conformity assessment bodies under the AI Ac --- Generated by overview.legal · https://overview.legal/topics/serious-incident-notification-ai · 2026-08-22