When and how must I report a serious AI incident under the EU AI Act?

Under the EU AI Act, incident reporting obligations for high-risk AI systems become a legal requirement starting August 2, 2026. Failure to comply can result in penalties up to 3% of global revenue.

The provided sources indicate that the EU AI Act will mandate incident reporting for AI systems classified as high-risk. This requirement is part of a broader set of cybersecurity and governance obligations that will take effect on August 2, 2026. The sources do not specify the exact "how" of reporting, such as the specific format, reporting channels, or timelines for reporting after an incident occurs. They also do not define what constitutes a "serious" AI incident. However, the emphasis on governance as a legal requirement suggests that organizations will need to establish clear processes for identifying, documenting, and reporting such incidents to avoid significant financial penalties.