AI incident reporting: EU AI Act Article 73 vs DoD guidance

Article 73 of the EU AI Act is a timed, statutory reporting duty for serious incidents involving high-risk AI systems placed on the Union market. Public DoD pages describe Responsible AI processes, a use-case/incident repository, and existing DoD reporting channels. They are not the same instrument. This page does not invent a DoD equivalent.

Status as of 14 October 2026: the Service Desk still presents the EUR-Lex consolidated version of the AI Act as at 27 July 2026, with NEW and AMENDED banners for the Digital Omnibus. Article 73 still uses the 15 days default, two days for named cases, and 10 days where a person dies. An incomplete initial report may still be followed by a complete one, and the provider shall not perform any investigation which involves altering the AI system before informing the authorities. The live Tradewinds AIA Toolkit is still a self-evaluation resource.

What Article 73 requires

The Commission’s AI Act Service Desk text of Article 73, based on the EUR-Lex consolidated Regulation, says providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.

The default clock is immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer becomes aware. Two shorter clocks sit on top of that:

• widespread infringement or a serious incident as defined in Article 3, point (49)(b): immediately, and not later than two days;
• death of a person: immediately after a causal relationship is established or suspected, not later than 10 days.

An incomplete initial report may be followed by a complete one. After reporting, the provider shall without delay, perform the necessary investigations, including a risk assessment of the incident, and corrective action, and shall not perform any investigation which involves altering the AI system in a way that could affect later evaluation of causes until the authorities are informed.

What counts as a serious incident

Article 3(49) defines a serious incident as an incident or malfunctioning that directly or indirectly leads to any of: (a) the death of a person, or serious harm to a person’s health; (b) a serious and irreversible disruption of the management or operation of critical infrastructure; (c) the infringement of obligations under Union law intended to protect fundamental rights; or (d) serious harm to property or the environment.

Article 73 applies to high-risk systems placed on the Union market. Military, defence and national-security systems used exclusively for those purposes sit outside the Regulation under Article 2(3). See EU AI Act scope for defense and aviation and EU AI Act obligations for aerospace suppliers outside the EU.

What public DoD pages actually say

The Department released the RAI Toolkit on 14 November 2023 as a voluntary process. The live Tradewinds page now titles it the AIA Toolkit and still calls it a self-evaluation resource. We have not found a source that makes completing the toolkit a statutory incident-reporting duty.

The Responsible AI Strategy and Implementation Pathway tells DoD AI developers and users they will have measures … to report potential concerns. One line of effort asks Component RAI Leads to report to the CDAO (no less than once per year) exemplary AI use cases, identifying best practices, failure modes, and risk mitigation strategies, including after-action reports as appropriate. Another line asks Components to establish processes for operators of AI-enabled capabilities to notify and report changes in capability performance, outcomes, emergent behavior, and/or disengagement in accordance with existing DoD processes.

The December 2024 Generative AI Responsible AI Toolkit asks what is the process for flagging incidents or concerns with the system and tells projects to describe your plan to update the RAI Incident Repository with any near misses. The same page labels the AI Incident Repository as In Development under LOE 1.2.1, and states that reporting concerns to the RAI Incident Repository does NOT automatically satisfy other reporting obligations.

CDAO’s Pathway to AI Readiness: Risk Management page asks, as a self-assessment question, whether the organization has protocols in place to respond to AI-specific security incidents and a continuous monitoring, assessment, and incident response plan. Those are questions, not a reporting statute.

Side-by-side, using only what each source claims

We have not found an official US page that maps Article 73 to a DoD clause, so this page does not invent that map. Cyber-incident clauses that apply when CUI is involved are a different regime; see CMMC and AI with CUI.

Questions

Does the DoD RAI Toolkit satisfy Article 73?

No official page we cite says that. Article 73 is a Union-market duty for high-risk systems. The toolkit is a US voluntary process.

Does reporting to the RAI Incident Repository close other DoD reporting?

The toolkit says it does NOT automatically satisfy other reporting obligations.

Is there a published DoD day-count for AI serious incidents?

The pages we cite give an annual use-case report and existing DoD processes for operator notices. We did not find a public DoD clock that matches Article 73’s 15-/10-/2-day structure.