Article 73 of the EU AI Act is the reporting rule for serious incidents involving covered AI systems, especially high-risk systems. It requires the provider to notify the relevant market surveillance authority within strict deadlines when an incident causes or may have caused significant harm, such as injury, rights violations, or major disruption. In practice, the reporting clock can start before a system is visibly “hacked”; it may begin when there is credible evidence that the AI’s output contributed to the harm.
This matters because AI incident response is not only about cybersecurity compromise. A model can be intact from a technical standpoint and still create a reportable event through a bad recommendation, unsafe decision, or flawed automation in a business process. Defenders should therefore preserve logs, model versions, prompts or inputs, outputs, and human approval records, then run a quick causality review. That helps teams decide whether the event is reportable and supports timely, defensible compliance.