The EU AI Act gives some AI incidents two days to report.
Writing in CIO, technology compliance leader Allan Dabre says Article 73 of the EU AI Act took effect on 2 August 2026, bringing a serious incident reporting duty.
The standard deadline is 15 days. When a death is involved, it drops to 10 days. A widespread incident or serious disruption to critical infrastructure must be reported within 2 days.
GDPR gives 72 hours and SEC rules give public companies four business days. Dabre's point is practical: those deadlines are already in incident response runbooks. Article 73 probably is not.
Guidance from the European Commission says an indirect causal link between an AI output and downstream harm is enough to trigger the duty. That includes a flawed credit assessment that leads to a loan denial.
The December 2027 deferral covers conformity assessments and technical documentation. It does not cover Article 73. These cases may not look like security events, but the reporting clock still starts.
Which of your live AI systems has a named owner who would notice the two-day case?
Sources
Every story here is open to read. The ERP LEADERS brief goes one step further.
The day in enterprise software, in one email: the stories that matter, the failures with their figures, one case taken apart. Read a sample or sign up for the brief.
Welcome back. · Issue 01
