In short
- Article 73 of Regulation (EU) 2024/1689 creates a reporting duty to market surveillance authorities, with clocks of 15, 10 and 2 days depending on the harm.
- The investigation itself is run by the provider. Article 73 requires the provider to perform the necessary investigations and to preserve the system until authorities have been informed.
- There is no independent investigator in the AI Act. Civil aviation has one: Regulation (EU) 996/2010 requires a permanent national safety investigation authority in every Member State.
- Aviation separates the two functions by design. A safety investigation under Regulation (EU) 996/2010 may not concern itself with apportioning blame, and runs separately from any proceeding that does.
- The practical consequence is evidential. The party with the strongest interest in a narrow finding is the party writing the first account, which is why the internal record matters more here than in regulated sectors with an outside investigator.
Every incident regime answers two questions: who must be told, and who finds out what happened. The EU AI Act answers the first one carefully and leaves the second one to the operator.
That gap is not an oversight in drafting so much as a design choice with consequences, and it is easiest to see by putting Article 73 next to a regime that made the opposite choice.
01What does Article 73 actually set up?
A reporting duty with three clocks, and an investigation run by the reporter.
| Trigger | Deadline | Runs from |
|---|---|---|
| Serious incident, general rule | 15 days | Awareness of the incident |
| Death of a person | 10 days | Awareness, report immediately once suspected |
| Widespread infringement | 2 days | Awareness, immediately |
| Critical infrastructure disruption | 2 days | Awareness, immediately |
The report goes to the market surveillance authority of the Member State where the incident occurred, which then informs other national authorities and the Commission. Choosing between overlapping clocks is its own problem, covered in which incident clock fires first.
Then comes the part that gets less attention. Article 73 requires the provider to perform the necessary investigations, including a risk assessment and corrective action, and not to alter the system in a way that would affect a later evaluation before informing the authorities. The duty to preserve evidence is there. The independent examiner of that evidence is not.
02Who investigates in a sector that already solved this?
A permanent authority that exists for nothing else.
Regulation (EU) No 996/2010 requires each Member State to maintain a permanent national civil aviation safety investigation authority, functionally independent of any party whose interests could conflict with the task. Its investigations have one purpose, preventing future accidents, and they may not concern themselves with apportioning blame or liability. They run separately from, and without prejudice to, any judicial or administrative proceeding that does apportion blame.
The separation is the mechanism, not a nicety. Because the safety investigator is not the punisher, participants can describe what they actually did, and the resulting reports are usable by the whole industry rather than defensive documents written for one.
03What follows from the AI Act having neither?
The first account of what happened is written by an interested party.
| Function | Civil aviation, 996/2010 | AI Act, 2024/1689 |
|---|---|---|
| Who establishes the facts | Independent safety investigation authority | The provider |
| Stated objective | Prevention, blame excluded | Compliance and enforcement |
| Relationship to sanctions | Separate proceedings | Same authority |
| Cross-border coordination | Encasia network | Commission informed by the authority |
| Public findings | Published safety reports | No equivalent duty |
Read the third row as the operational risk. When the body receiving your account is also the body that can fine you, the incentive is to write the narrowest defensible account, and nothing in the regime corrects for that.
For agent systems the gap widens further, because the causal chain runs through tool calls, retrieved content and intermediate decisions that leave no trace unless someone chose to record them. What an outside investigator would ask for is exactly the record most agent deployments do not keep.
04What should an operator do about a gap it cannot fix?
Build the record that an independent investigator would have demanded.
That means deciding in advance what would be needed to reconstruct a decision: the system version, the inputs, the retrieved material, the tool calls, the human interventions and their timing. It means keeping that record beyond the incident window rather than in a rotating buffer, because Article 73 obliges you not to alter the system before authorities are informed and says nothing about logs that expired on their own schedule.
It also means writing the internal account before the regulatory one. A factual reconstruction produced for your own engineers, separate from the document sent to an authority, is the closest an organisation can get to the aviation separation on its own. The two will differ in tone, and the difference is informative.
The dates give a short window to build this. The Article 73 clocks begin for standalone Annex III systems on 2 December 2027, and the reporting duties themselves are easier to satisfy from a logging design chosen now than from one retrofitted after the first incident.
05Frequently asked questions
Who investigates a serious AI incident in the EU?
The provider does, under Article 73, and reports to the market surveillance authority of the Member State where the incident occurred. That authority holds enforcement powers, but the AI Act creates no separate body whose only job is to establish what happened.
What are the reporting deadlines under Article 73?
Fifteen days from awareness as the general rule, cut to two days for a widespread infringement or a serious and irreversible disruption of critical infrastructure, and ten days where the incident involved the death of a person.
How does aviation handle this differently?
Regulation (EU) 996/2010 requires each Member State to maintain a permanent civil aviation safety investigation authority that is functionally independent of any party whose interests could conflict with its task, and whose sole objective is preventing future accidents.
Why does an independent investigator matter for AI?
Because the operator investigating itself decides what counts as a cause. Aviation separates fact-finding from blame so that people disclose freely, and nothing equivalent exists for AI systems, so the quality of the account depends on the operator's own logging.
06References and method
- Regulation (EU) 2024/1689, Article 73, for the reporting duty, the 15 day, 10 day and 2 day clocks, and the requirement that the provider performs the necessary investigations and preserves the system.
- Article 73 of Regulation (EU) 2024/1689 in the consolidated presentation, checked on 17 September 2026 for the wording of the clocks and for the absence of any independent investigation body.
- Regulation (EU) No 996/2010 on the investigation and prevention of accidents and incidents in civil aviation, for the permanent national safety investigation authority, its functional independence, the prohibition on apportioning blame and the European network of those authorities known as Encasia.
- Regulation (EU) 2026/1744, for the deferral of the Annex III high-risk obligations to 2 December 2027, which is when the Article 73 clocks begin to run for standalone systems.