Three deadlines, and the moment they start

The EU AI Act does not set one reporting deadline. Article 73 sets three, and which one applies depends on what happened. Getting this wrong is not a filing error; it is the difference between a report that is on time and one that is a week late.

The three deadlines in Article 73

• 15 days is the general deadline for a serious incident.
• 10 days where a person has died.
• 2 days for a widespread infringement, or a serious and irreversible disruption of critical infrastructure.

The structure repays a moment's thought. The shortest deadline is not attached to the most severe individual harm. A death gets ten days; a widespread infringement gets two. The logic is containment rather than gravity. A death has already happened and cannot be undone by speed. A widespread infringement or an infrastructure disruption is typically still running, and every day of delay adds to the affected population. The deadlines are calibrated to what a fast report can still prevent.

Article 73 also permits an initial incomplete report followed by a complete one. This is the provision that resolves the tension people feel most sharply. You are not required to have the full picture within two days. You are required to have told the authority within two days. Waiting for a complete investigation before reporting is a choice to miss the deadline in order to produce a better document, and the Act explicitly says you do not have to make that trade.

Where the clock starts

The clock runs from awareness, not from the date of the malfunction and not from the date the classification was made. This single fact should shape how the whole process is designed.

Two consequences follow, and they are the practical heart of this module.

First: time spent deciding whether it qualifies is time spent inside the deadline. If a suspected incident sits with an analyst for six days while they establish whether it meets Article 3(49), and the answer turns out to be a widespread infringement with a two-day deadline, the organisation was already four days late before anyone began drafting.

Second: severity definitions have to be agreed before the incident. This is the teaching point. Every organisation that has been through this discovers the same thing: the definitions debate is unavoidable, and you get to choose only whether it happens in calm conditions or on the clock. Arguing about whether something is "widespread" while the deadline runs is the worst possible time to be forming a view, because everyone in the room has an interest in the answer.

So the artefact this module is about is not an incident report. It is a one-page table, written in advance, that says: this pattern of facts is this severity, goes to this person, within this time. Agreed when nobody is under pressure and nobody knows which case it will be applied to.

California SB 53: a second set of clocks

If your organisation is in scope of California SB 53, effective 1 January 2026, there is a separate regime running alongside. It applies to frontier developers, with a frontier model threshold of 10^26 FLOPs and a large frontier developer threshold of $500m annual revenue, and it requires reporting of critical safety incidents to the California Office of Emergency Services within 15 days, or within 24 hours where there is an imminent risk of death or serious physical injury. Penalties run up to $1m per violation.

Note what the 24-hour rule is keyed to: imminent risk, not realised harm. It fires while the harm is still avoidable, which is the same containment logic as the EU two-day deadline, taken further.

Two regimes, different triggers, different recipients, overlapping facts. If both could apply to you, the escalation table needs a column for each. The one arrangement that does not work is a single deadline applied to everything, because it will be wrong in one direction or the other every time.

As of 24 September 2026.