EU AI Act Post-Market Monitoring and Serious Incident Reporting

Article 72 requires providers to establish and document a post-market monitoring system proportionate to the nature of the AI technology and the risks of the high-risk system. It should actively and systematically collect, document, and analyse relevant data provided by deployers or collected through other sources about performance throughout the system’s lifetime. The system feeds updates to risk assessment and may lead to corrective action. It complements, rather than replaces, provider quality management, deployer monitoring, and other sectoral safety obligations. Article 73 covers reporting of serious incidents. Providers must report to the market surveillance authorities of the Member States where the incident occurred, subject to the Regulation’s timelines and process. The Act includes a special deadline for incidents involving death: report as soon as a causal relationship is established or suspected, and no later than ten days after awareness. Other incidents have different deadlines based on severity and awareness. Do not compress these into one rule; consult the operative article for the specific event. Deployers have duties to inform providers or relevant authorities when they identify risks or serious incidents in operation, following the channels required by the Act. They should preserve relevant logs and cooperate with investigations. A provider should establish usable reporting routes, triage evidence, protect personal data, and maintain a record of decisions. An internal ticket or user complaint may be an early signal but does not automatically meet the legal definition of a serious incident. The practical system links post-market evidence to action: detect a signal, assess whether it relates to the AI system, determine severity and reporting duties, notify the right authority within the applicable period, and take corrective measures when needed. Assign named responsibility and escalation coverage outside business hours. Make sure vendors and deployers can supply information quickly, while avoiding unsupported conclusions about causation before investigation.