European Tech Incident Rules: Classify at Suspicion, Then Notify and Escalate—Article 73

According to the European Commission's digital-strategy materials, the AI Act’s applicable serious-incident reporting provision sets a reporting window of 15 days. For providers of high-risk AI systems, awareness of a serious incident or malfunction starts the clock; the period is not a grace period for waiting until an investigation proves what happened.

The 15 days make classification at suspicion the operational rule. A reasonably suspected qualifying incident requires evidence preservation, an internal investigation, escalation, and notice to the competent market surveillance authority in the Member State where the event occurred or had effect. Those tracks run in parallel. Internal escalation cannot substitute for regulator notice, and uncertainty should shape the inquiry rather than suspend the obligation.

Within 15 days, the report must do more than announce a failure. It must describe the incident, identify the AI system and its intended purpose, and explain corrective actions taken or planned. The file should also support post-market monitoring through documentation and analysis. In practice, “wait for certainty” is a warning sign: classify at suspicion, start the response, notify the authority, and escalate while facts are still developing.

Start at Suspicion

The first reporting decision is legal classification, not root cause. The European Union AI Act’s applicability provisions create two commencement lanes. Record whether the system is an Annex III use-case high-risk system or an Article 6(1) regulated product, identify the legal provider, preserve the classification basis, and date the triggering information. Selecting a form before taking that step can route the incident into the wrong regime.

The applicable serious-incident reporting provision is provider-specific, not a general reporting duty for every developer or deployer. Its trigger is the provider’s awareness, or reasonable cause to suspect, an Article 3(49) serious incident: death, serious harm to health, a serious fundamental-rights violation, serious property or environmental damage, or large-scale public-interest harm. Confirmation is not required. A credible support or safety signal that supports suspicion starts the reporting workflow while technical investigation continues.

The reporting provision measures the ordinary reporting period from awareness or reasonable suspicion and requires notice as soon as possible, subject to the hard outer limit shown below. That limit is not an investigation buffer or a period for deciding whether the incident is serious enough to report. Reject the queue-building rule: investigate first, then escalate only if root-cause proof establishes serious harm. Plausible qualifying harm is sufficient. Any parallel internal escalation must preserve, not toll, the external reporting date.

The shorter disruption branch controls only when immediate reporting is likely to cause an immediate and substantial disruption of critical infrastructure. Even on that path, notice remains immediate, subject to the outer cap below. Critical-sector deployment alone does not qualify. Require a written, incident-specific factual basis identifying the expected disruption, critical dependency, timing, magnitude, and why notice is likely to cause it. A rail operator cannot invoke the branch merely because its AI supports transport. Without that basis, use the ordinary route and its as-soon-as-possible duty.

Incomplete facts call for staging, not silence. If a full notification cannot be made within the ordinary outer-limit period, send a preliminary report containing available information, followed by one or more updates inside the statutory follow-up window. Missing data may justify staged delivery; it does not justify resetting the original awareness or reasonable-suspicion date.

The external actor is the provider—or its authorized representative when the provider is outside the Union. It reports to the AI Office and, where applicable, the national competent authority in the Member State where the incident occurred or had effect. Supply Annex XII information as far as possible, including system type, country of service, incident description, harm location, and other requested information; the notification must be in English. Before any handoff, require a classification-and-clock record containing the scope lane, provider or representative, trigger evidence, recipient list, selected route, disruption assessment if applicable, and update owner.

From 62 to a Higher Count: Why Escalation Cannot Be Optional

Escalation is not optional when the incident stream is accelerating and the law assigns a monetary ceiling to reporting failures. The reliable control is a standing intake-and-escalation system that can classify a signal, name an owner, and transmit the required notice while root-cause investigation continues in parallel—not after it proves the signal was serious.

Start with scope discipline. According to Stanford Institute for Human-Centered AI’s AI Index, the AI Incident Database provides a global baseline, but it does not count only European Union events or events reportable under the AI Act’s serious-incident reporting provision. The baseline is still useful: it shows that providers need an intake route spanning support, security, product, compliance, and public affairs, with preserved receipt time, system identity, and accountable ownership. Without that shared record, an external signal can become internal routing delay.

The next annual observation turns that concern into a measurable management test. According to the same Stanford report, incident volume rose sharply in the following year. A provider should therefore ensure that alerts promptly receive an identifier, timestamp, owner, preliminary facts, and decision status; final causal certainty should not be a prerequisite for any of those steps. For a covered Annex III provider, awareness of—or reasonable suspicion of—a serious incident starts the notice track. The external path to the AI Office and, where applicable, the national competent authority proceeds as soon as possible while internal escalation continues. The ordinary outer limit is not an investigation grace period. This is where the belief that a team may investigate first and escalate only after proving seriousness fails.

Stanford’s AI Index 2025 extends the acceleration rather than presenting the earlier baseline as a one-off. The updated series supports a system that recognizes, timestamps, and escalates incident signals consistently; otherwise, a larger queue increases the chance that a legally significant signal will be treated as ordinary product feedback. The statutory critical-infrastructure disruption branch remains the controlling route when its condition is met. It is not postponed while teams debate upstream causation: the duty-holder must issue the required notice through the applicable disruption path while the technical investigation continues beside it.

The European Union AI Act adds the governance consequence. Under Article 99(4)(g), noncompliance with the serious-incident reporting provision can expose a provider to the statutory ceiling stated below. That figure is maximum legal exposure, not an incurred fine, a forecast, or evidence that a particular provider has been penalized. It makes escalation ownership a governance control rather than an informal favor between teams. The actionable close is to require one named incident owner to maintain the intake record, document the awareness-or-suspicion decision, and keep notice and root-cause work on parallel tracks from the first qualifying signal.

Notify vs Escalate: The Two-Track Response Wins

Escalation is not the alternative to notice; it is the control that makes notice timely and defensible. From the applicability date identified above, a covered provider must notify the AI Office and, where applicable, the national competent authority as soon as possible while activating internal response. The ordinary outer limit already explained is a ceiling, not a grace period. When the statutory critical-infrastructure disruption condition is met, the shorter disruption path already explained controls.

Apply the veto gates in fixed order: provider status, plausible statutory harm, and timeliness. Provider status asks whether the covered-provider condition is present. Plausible statutory harm asks whether the signal creates awareness or reasonable cause to suspect an Article 3(49) serious incident. Timeliness asks whether the applicable notice can issue now, including a preliminary notice when material facts remain incomplete. Record each gate as pass, fail, or unresolved. An unresolved gate triggers immediate legal triage; it never authorizes closure of the reporting lane. If scope is unclear, specialist advice and legal-role mapping proceed in parallel while the original awareness record remains intact.

Maintain one timestamped, append-only evidence-to-decision chain: the first credible signal; facts supporting or opposing seriousness; scope analysis; decision maker; unresolved questions; and the stated reasons for selecting one table path over another. Later evidence that reduces perceived severity must be added, not allowed to reset the original awareness time. According to Pryme Intelligence, governed agents provide traceability by linking every response clause to its authorizing policy, certificate, and execution depth, while escalation gates name a real owner and verify authorized bounds. That is an operational analogy, not authority for legal classification, but it supplies a sound recordkeeping model.

Before anyone departs from the winning row, require written legal sign-off identifying the proposed path, factual basis, unresolved questions, and continuing controls. If the statutory rule remains satisfied, the compliant outcome is still report and escalate; sign-off controls deviation but does not authorize omitting notice. Leadership preference, executive visibility, or uncertainty about complete root cause may change containment, communications, or remediation posture, but cannot be the sole recorded reason for withholding notice. Reject the shortcut that permits investigation until root cause proves seriousness: that sequence reverses the legal trigger. Configure the evidence chain and RACI as one incident record before the next qualifying signal.

Counter-Evidence

Once the current notification regime applies, an empty public enforcement record is a weak signal, not a safety finding. Confidentiality, incomplete incident taxonomies, underreporting, and the relative novelty of the serious-incident reporting practice can leave qualifying events invisible. A lack of published cases is therefore not evidence that no qualifying events occurred. The relevant question is whether a covered provider of an Annex III high-risk system is aware of, or has reasonable cause to suspect, a serious incident.

Broad AI-incident totals are not legal totals. Public databases commonly rely on media reports, voluntary disclosures, and technical taxonomies, while a determination under the serious-incident reporting provision turns on the provider, intended use, consequences, evidence of awareness, and organizational context. According to the European Commission’s digital-strategy materials, the report must describe the incident and AI system, state intended purpose, and identify corrective actions taken or planned. Those case-specific fields separate a documented legal assessment from a media or technical label.

Error volume is not harm. The same error count can mean isolated, reversible inconvenience in one deployment and widespread wrongful deprivation of benefits, safety harm, or discrimination in another. Assess affected people, severity, duration, and recoverability separately. If those facts are incomplete, escalate the uncertainty in parallel with the notice analysis; the ordinary outer limit is not an investigation grace period.

An “AI” label establishes neither coverage nor the duty holder. High-risk status can vary with intended purpose, deployment context, and sector, while responsibility can vary with the organization’s role as provider, deployer, importer, or supplier. I would require a written classification memo identifying the role, purpose, context, conclusion, and reasons to reconsider it if deployment changes. Marketing terminology cannot carry that judgment.

The statutory critical-infrastructure disruption branch is not a sector shortcut. Its counterfactual test is whether immediate external notice is likely to cause an immediate and substantial disruption of critical infrastructure—not whether the system supports that sector. Timing, dependencies, notice content, and feasible mitigation must be assessed. If the condition is met, the shorter path controls; if it is not established on known facts, the ordinary outer-limit regime remains relevant, but it is a ceiling rather than permission to wait. An incomplete record should preserve the counterfactual question, not settle it from a logo.

Parallel escalation is not a statutory chain of command. The serious-incident reporting provision prescribes external notification; an internal escalation tree, DPO involvement, executive notification, and a RACI are governance controls, not substitutes or a reason to hold the notice. I would design and audit them as organization-specific systems: designate who may declare suspicion, who owns the classification memo, who coordinates the filing, and how the timestamped record shows both tracks moving together. If the covered-provider or serious-incident predicate is genuinely absent, document why; if the provider is aware of, or has reasonable cause to suspect, the incident, escalate and notify the AI Office and, where applicable, the national competent authority as soon as possible. Uncertainty is a reason to review in parallel, not to wait for root-cause proof.

Dutch Families

The Dutch National Ombudsman’s 2021 reporting found that families were subjected to wrongful fraud accusations by the tax authorities after high-risk eligibility and fraud-screening processes. According to the Dutch Data Protection Authority’s announced decision in the same affair, discriminatory nationality processing resulted in a 2.75 million fine. That is historical regulatory context—not a penalty under the AI Act’s serious-incident reporting provision, a damages estimate, or an AI Act judgment. It therefore cannot establish an AI Act violation.

This exercise is explicitly counterfactual. Assume that in 2026 a covered provider uses a high-risk system listed in Annex III to determine eligibility for essential public benefits, and a validated diagnostic recreates the discriminatory-referral pattern. The historical event predates the serious-incident reporting regime; it illustrates the mechanism but cannot prove a present breach. At T0, repeated wrongful adverse referrals create reasonable suspicion of potentially large-scale fundamental-rights harm and, for this assumed case, an Article 3(49) serious incident. The provider must open both a regulatory-notification file and an organizational-response file that day. A diagnostic does not have to establish the ultimate root cause before notice, and an outer reporting limit is not an investigation window.

For this worked case, “as soon as possible” is operationally implemented through a same-day preliminary report rather than a final root-cause memorandum. An affected-count range is valuable because it communicates uncertainty without converting the absence of a precise count into grounds for delay. Corrective action does not suspend the reporting duty, and internal escalation does not replace external notice. The worked-case verdict is therefore external notice plus parallel internal escalation, not escalation alone. Once reasonable suspicion exists at T0, management must simultaneously notify, contain harm, preserve evidence, investigate, and correct until remediation is independently verified.

Five Decision Rules

A defensible incident file is a five-gate control, not a committee calendar. Establish provider status, lock the awareness time, test plausible severity, launch notice beside remediation, and preserve the file until accountable closure. Later executive review may change the investigation, but it cannot reset the awareness record or make the reporting lane internal-only.