Financial firms have just four hours to tell a regulator about a major tech failure once they call it major [9]. Yet most European artificial intelligence (AI) incident plans rely on a 15-day deadline from the AI Act [1]. That 15-day report belongs to the AI vendor, and the law now delays it until 2 December 2027 [2][3].

The big picture:

The duty to report a serious AI incident falls on whoever puts the high-risk system on the market. Providers must tell a state watchdog as soon as they link the system to the incident, and within 15 days at the latest [1].

That deadline drops to two days for a break in critical systems. It drops to 10 days if a person dies [1].

A “serious incident” covers a lot of ground. It takes in death, health harm, system breaks, breaches of basic rights, and bad damage to property or the environment [4]. That rights clause is the one that could pull an agent’s leak of personal data into the report.

What strikes me here is who does not file. The enterprise running the system has a different job.

When a deployer spots a serious incident, it must stop the system and tell the provider and importer [2]. No filing deadline applies to that action.

Then the timeline moved. A new rule, Regulation (EU) 2026/1744, pushed the high-risk duties to 2 December 2027 [3]. Systems built into regulated products get until 2 August 2028 [3].

The deployer’s own duties share those dates [2]. So the enterprise waits until late 2027 for a duty it never owned.

The clocks that matter today run much faster in other rulebooks. A data breach goes to the data regulator within 72 hours [7]. A big incident under the European Union’s network and information security (NIS2) rules needs an early warning within 24 hours [8].

Under the Digital Operational Resilience Act (DORA), financial firms face a tighter window. They must flag a major tech failure within four hours of calling it major [9]. They get at most 24 hours from discovery [9].

By the numbers

  • 15 days — Provider report: The AI Act deadline for a serious incident, counted from awareness [1].
  • 2 December 2027 — New start date: The delayed start for high-risk rules, which includes the incident report [3].
  • 24 hours — Early warning: The first of three NIS2 filings for a big system failure [8].
  • Four hours — DORA deadline: How long a financial firm has to report after calling an incident major [9].

What I’d watch:

The teams closest to this no longer treat these notices as paperwork. They treat the choice to label an incident as the real deadline. What I’d watch next:

  • Where the timer starts: DORA’s four-hour limit runs from the choice to call it major, with a strict 24-hour limit from discovery [9]. Reading back what an agent did is slower than any of these clocks.
  • Accidental provider status: A deployer becomes a provider if it puts its brand on the system, makes a big change, or shifts the intended use [5]. The part I keep circling is that taking this role pulls the 15-day report right back onto the enterprise [1][5].
  • The active AI Act clock: Providers of general-purpose models with systemic risk have faced serious incident rules since 2 August 2025 [6]. That clock sits with the model vendor, so for an enterprise it is a contract issue.
  • Vendor notice promises: If the 15-day report belongs to the vendor, the enterprise’s own 72-hour clock starts when it knows enough to act [7]. Whether a contract promises notice in hours or days decides if that deadline gets met.

The catch

No single number fits every enterprise. Four hours binds financial firms [9]. The 24-hour clock covers firms inside the network and information security rules [8].

The 72-hour clock applies when personal data leaks [7]. If none of those rules reaches the event, the enterprise owes no notice at all.

There is a second limit. A notice tells a regulator what happened. It does not stop the agent.

I could be wrong, but the order looks fixed: the clock is short, the label starts it, and the label moves only as fast as the system logs.

The date change cuts both ways. The December 2027 runway is real for a deployer’s basic duties. But it defers nothing for a firm that takes the provider role by branding or changing a system [5].

At a glance

  • The Big Shift: Europe’s AI Act report on serious incidents is a vendor duty, and a new EU rule pushed it to 2 December 2027. The clocks running on an enterprise are much shorter: 72 hours for a personal data breach [7], 24 hours for an early warning under NIS2 [8], and four hours under DORA [9].
  • Why It Matters: Incident plans built on a 15-day timeline prepare for a filing the enterprise may not owe. The deadlines that do bind an enterprise start with a fast choice to label the event. Taking a provider role by branding pulls the AI Act timeline back onto the company [5].
  • What I’d Watch: Whether the choice to label an incident moves inside the timer, and whether a company takes the provider role without knowing it.
  • Serious incident: An AI system failure leading to death, health harm, critical system breaks, rights breaches, or bad environmental damage [4].
  • Early warning: The first NIS2 filing for a big incident, due within 24 hours [8].
  • Major ICT-related incident: An Information and Communication Technology (ICT) event that triggers a four-hour alert clock for financial firms [9].
  • The Catch: The shortest applicable clock wins, turning on the rulebook rather than the tech itself. Where no specific rule applies, the enterprise files nothing.

Related reading

Sources

[1] EU Artificial Intelligence Act — Article 73, Reporting of Serious Incidents (https://artificialintelligenceact.eu/article/73/) [2] EU Artificial Intelligence Act — Article 26, Obligations of Deployers of High-Risk AI Systems (https://artificialintelligenceact.eu/article/26/) [3] EU Artificial Intelligence Act — Digital Omnibus on AI (Regulation (EU) 2026/1744), amended Article 113 (https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus) [4] EU Artificial Intelligence Act — Article 3, definition of “serious incident” (https://artificialintelligenceact.eu/article/3/) [5] EU Artificial Intelligence Act — Article 25, Responsibilities Along the AI Value Chain (https://artificialintelligenceact.eu/article/25/) [6] EU Artificial Intelligence Act — Article 55, Obligations of Providers of General-Purpose AI Models with Systemic Risk (https://artificialintelligenceact.eu/article/55/) [7] General Data Protection Regulation — Article 33, Notification of a personal data breach to the supervisory authority (https://gdpr-info.eu/art-33-gdpr/) [8] NIS2 Directive (EU) 2022/2555 — Article 23, Reporting obligations (https://www.nis-2-directive.com/NIS_2_Directive_Article_23.html) [9] FMA Austria — DORA: ICT-related incidents, initial notification within four hours of classification (Delegated Regulation (EU) 2025/301) (https://www.fma.gv.at/en/cross-sectoral-topics/dora/dora-ict-related-incidents)