Serious Incident Definitions Under Article 73 of the EU AI Act

Understanding Serious Incidents in AI Systems

Article 73 of the EU AI Act establishes the framework for identifying and managing serious incidents involving AI systems. Practitioners must understand what constitutes a serious incident to ensure proper response protocols. These incidents represent significant failures that could cause harm to individuals or society.

The definitions provided in this article guide organisations through their incident response obligations.

A serious incident involves AI systems that have caused or could cause serious harm. This includes situations where the AI system has failed to perform as expected or has produced outcomes that pose genuine risks. The definitions focus on the potential or actual impact rather than just technical malfunction.

Practitioners should consider both immediate and long-term consequences when assessing incident severity.

Key Elements of Serious Incident Classification

The definitions under Article 73 identify several categories of serious incidents. These classifications help practitioners determine when to activate incident response procedures. The primary categories include incidents causing death, serious injury, or significant property damage.

Each category requires specific attention and reporting procedures.

• Death or serious injury – This includes any incident where an AI system directly or indirectly causes death or serious physical harm to individuals. Examples might involve autonomous vehicle systems failing to detect pedestrians or medical AI systems providing incorrect diagnoses that result in patient harm.
• Significant property damage – This covers incidents causing substantial financial loss or damage to property. Examples include AI trading systems causing massive financial losses or automated manufacturing systems causing equipment failure that results in expensive damage.
• Other serious impacts – This category encompasses incidents causing significant environmental damage or serious disruption to essential services. Examples might involve AI systems affecting critical infrastructure or causing widespread service interruptions.

Organisations must evaluate each incident against these criteria to determine if it meets the serious incident threshold. The assessment process involves considering both direct and indirect consequences of AI system failures. Practitioners should document their evaluation process to support incident classification decisions.

Practical Application in Workplace Scenarios

Real-world examples help illustrate how these definitions apply in practice. Consider an AI-powered clinical decision support system that provides incorrect treatment recommendations. If this leads to patient harm or death, it clearly meets the serious incident definition.

The clinical team must immediately activate their incident response protocols and notify relevant authorities.

Another scenario involves an AI system used for financial risk assessment. If this system consistently rejects legitimate loan applications due to algorithmic bias, it could cause significant financial harm to applicants. While not immediately causing physical injury, this represents a serious incident requiring investigation and remediation.

The organisation must assess the impact on affected individuals and implement corrective measures.

Manufacturing environments present different challenges. An AI system controlling automated machinery that fails to detect faults might cause equipment damage or workplace injuries. The incident classification depends on whether the failure results in property damage or personal injury.

Practitioners must evaluate the system’s safety controls and operational procedures to determine incident severity.

Organisations should develop clear procedures for incident classification. These procedures must include specific criteria for determining when an incident meets the serious incident threshold. Regular training ensures staff understand these definitions and can apply them consistently.

The classification process should involve multiple stakeholders including technical teams, legal advisors, and senior management.

Documentation plays a crucial role in incident response. Practitioners must maintain detailed records of incident assessment processes and classification decisions. These records support regulatory compliance and provide evidence of proper incident management.

The documentation should include technical analysis, impact assessment, and decision rationale for classification.

Effective incident response requires understanding that serious incidents extend beyond immediate technical failures. The definitions consider broader implications including legal, financial, and reputational consequences. Practitioners must evaluate these wider impacts when determining incident severity.

This approach ensures organisations respond appropriately to incidents that may not cause immediate harm but have significant potential consequences.