Under the EU AI Act, providers of general-purpose AI (GPAI) models classified as posing systemic risk must track, document and report information about serious incidents and possible corrective measures to the European AI Office and, where appropriate, national competent authorities. Article 55(1)(c) requires reporting without undue delay; it does not set one universal number of days.
This is a general explanation of the EU framework, not advice about a specific incident.
Article 55 sets the rule for systemic-risk GPAI providers
A GPAI model can perform a wide range of tasks. Under Article 55, the reporting duty applies to providers of those models that pose systemic risk. The European Commission says the GPAI-provider rules apply to providers placing models on the EU market whether they are based inside or outside the bloc. Those obligations entered into application on August 2, 2025.
The duty covers relevant information about serious incidents and possible corrective measures. The AI Act’s definition of a serious incident lists death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of EU-law obligations protecting fundamental rights, and serious harm to property or the environment.
The Commission’s guidance interprets Article 55’s serious-incident reporting duty to include serious cybersecurity breaches related to a model or its physical infrastructure, including cyberattacks and model-weight exfiltration. The guidance is nonbinding, but the Commission says it reflects its interpretation and will guide enforcement.
The Code adds a schedule for its signatories
Article 55 says to report without undue delay. The General-Purpose AI Code of Practice gives signatories a more specific schedule for serious cybersecurity breaches: an initial report no later than five days after the provider becomes aware of the model’s involvement, updates at least every four weeks while the incident remains unresolved, and a final report no later than 60 days after resolution. The Code also calls for retaining documentation for five years, measured from the later of the documentation date or the incident date.
The Commission describes adherence to the Code as one way to demonstrate compliance. Providers may instead use other adequate measures. The Code’s five-day schedule is therefore a commitment under that route, not a five-day deadline written into Article 55 for every provider and incident.
Article 73 covers a different reporting route
Article 73 applies to providers of high-risk AI systems placed on the EU market. Reports go to the market-surveillance authority in the Member State where the incident occurred. Its deadlines depend on the incident and when the provider, or where applicable the deployer, becomes aware of it.
| Reporting route | Who and what it covers | Recipient | Timing |
| Article 55 | Providers of GPAI models with systemic risk; serious-incident information and possible corrective measures | The AI Office and, where appropriate, national competent authorities | Without undue delay |
| Code of Practice | Signatories reporting serious cybersecurity breaches involving a model | The AI Office and, where applicable, national competent authorities | Initial report within five days of awareness of model involvement; updates at least every four weeks while unresolved; final report within 60 days after resolution |
| Article 73 | Providers of high-risk AI systems placed on the EU market; serious incidents involving the system | Market-surveillance authority in the Member State where the incident occurred | Immediately after establishing a causal link or reasonable likelihood, and no later than 15 days after awareness; two days for a widespread infringement or qualifying critical-infrastructure incident; 10 days in a death case, subject to the provision’s conditions |
Article 73 also requires providers to investigate without delay, assess risk, take corrective action and cooperate with authorities. When timely reporting requires it, a provider or deployer may submit an incomplete initial report and follow it with a complete one. The authority must take appropriate measures within seven days of receiving a notification.
For a compliance assessment, first identify whether the obligation concerns a systemic-risk GPAI model or a high-risk AI system. That determines which reporting route, recipient and timing rules are relevant; Article 73’s deadlines do not replace Article 55’s standard.
Cyber incidents and models in development
The Act’s serious-incident definition is framed around incidents or malfunctions of AI systems, while Article 55 addresses systemic-risk GPAI models. The Commission’s guidance includes serious cyber breaches related to a model or its infrastructure. Whether that interpretation covers a model acting as the attacker in a particular incident remains a legal question.
An October 19, 2026, legal analysis by Hannes Bastians and Maarten Herbosch in Lawfare argues that the wording can cover model-initiated cyber activity. That is an interpretation, not a court determination. The Commission’s Q&A says the Court of Justice of the European Union is the body competent to interpret the Act authoritatively.
The Commission also says the Act generally does not apply to research, testing or development before a model is placed on the market or put into service. It identifies some GPAI obligations, including Article 55 risk assessment and mitigation, as relevant during development of models intended for the market. That explanation does not make every internal model or development-stage incident subject to the same reporting duty.
