When a high-risk AI incident occurs, the organization needs more than a ticket number. It needs a reconstructable record of the system state, facts, evidence, authority, escalation, corrective action and reporting position before the evidence disappears or the system changes.
Use the current consolidated Regulation as the controlling source for the serious-incident definition, operator responsibilities and Article 73 reporting requirements. Reporting timelines and duties depend on the actual system, role and incident circumstances.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Do not label every malfunction a reportable serious incident or dismiss a harmful event as merely technical. Preserve the facts, consequences, system identity and applicable definition before making the reporting determination.
Incident governance depends on chronology. Record detection time, evidence sources, affected system version, people notified, provider/deployer communications, escalation and the basis for each consequential action.
Logs, prompts or inputs where relevant, outputs, model and software versions, configuration, monitoring data, human interventions and other volatile evidence can disappear during remediation. Preserve the record before overwriting the state.
Suspension, rollback, restriction, notification, provider action, technical repair and other interventions should be connected to authority, evidence and outcome so the organization can show what happened after the incident was identified.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Identify the AI system, version, use context, operator role, time window, reported harm or risk and the source of the initial signal.
Capture relevant logs, records, communications, decisions and system state before remediation destroys the ability to reconstruct what occurred.
Map the facts to the current legal definition, applicable operator duties and competent reporting route. Preserve uncertainty and escalate rather than inventing a reportability conclusion.
Record what authority acted, what changed, what evidence supports closure, and whether the system may return to use or requires further review.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
The Regulation defines serious incident in Article 3 and uses that definition in the applicable reporting framework. The determination depends on the actual event and consequences, so organizations should check the current consolidated legal text rather than rely on a generic incident label.
Article 73 establishes reporting duties for providers of high-risk AI systems in the circumstances covered by that provision. Other operators can have related monitoring, notification, cooperation or escalation duties, so role and system classification should be established first.
Article 73 contains timing requirements that vary with the circumstances, including accelerated treatment for certain serious events. Because timing can be legally consequential, the current consolidated provision and the actual incident facts should be checked immediately rather than relying on a static summary.
Relevant material can include system and model version, configuration, logs, inputs and outputs where appropriate, monitoring data, notices, communications, human interventions, decisions, corrective actions and the chronology connecting them.
Urgent safety or legal action may need to occur immediately, but evidence preservation should be incorporated into the response wherever possible. Uncontrolled remediation can destroy the record needed to understand the event and demonstrate what was done.
TA-14 can structure the facts, role, evidence, chronology, gaps, authority and escalation record. It does not replace competent legal advice or the authority responsible for a binding regulatory determination.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views