#
Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.
4 instruments (4 current) · 3 obligations · 3 claims · 8 milestones
Instruments
- Artificial Intelligence Act Valid from 2024-08-01
Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.
- Cyber Resilience Act Valid from 2024-12-10
Cybersecurity requirements for products with digital elements; the AI Act treats compliance with the CRA's essential requirements as supporting Article 15 cybersecurity compliance for high-risk AI.
- Draft guidance and reporting template on serious AI incidents Draft, no legal force
Draft Commission guidance and template for Article 73 serious incident reporting.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland) Draft, no legal force
Pre-legislative draft heads of the Irish AI implementing bill, covering the national register, serious incident reporting and contravention notices.
Obligations
- Article 73(1)-(2)
Providers of high-risk AI systems must report serious incidents to the market surveillance authorities of the Member State where it occurred, immediately and in any event within 15 days of awareness.
- Head 42(1)
Providers of high-risk AI systems would report serious incidents to the relevant Irish market surveillance authority (draft head).
- Article 14(1)
Manufacturers must notify actively exploited vulnerabilities in products with digital elements to the designated CSIRT and ENISA.
Milestones
- Entry into force of the AI Act Met
- Chapters I and II (definitions, prohibitions) apply Met
- Governance, GPAI obligations and penalties apply; Member States designate authorities Met
- Cyber Resilience Act Chapter IV (conformity assessment bodies) applies Met
- General application; Article 50 transparency rules and enforcement start Met
- Cyber Resilience Act Article 14 reporting of actively exploited vulnerabilities applies Met
- Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
- Cyber Resilience Act applies generally Upcoming
Claims and evidence (3)
High-risk AI providers must meet Article 16 duties and report serious incidents under Article 73, and deployers must meet Article 26 duties, from 2 December 2027 for Annex III systems.
Evidence and sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
Providers of high-risk AI systems shall: (a) ensure that their high-risk AI systems are compliant with the requirements set out in Section 2
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
The Commission issued draft guidance and a reporting template on serious AI incidents on 26 September 2025 with feedback closing on 7 November 2025.
Evidence and sources
- AI Act: Commission issues draft guidance and reporting template on serious AI incidents
Closing: 07 November 2025 Stakeholders are encouraged to provide feedback and examples on the interplay with other reporting regimes in this public consultation.
- AI Act: Commission issues draft guidance and reporting template on serious AI incidents
Under the EU AI Act, providers of high-risk AI systems will be required to report serious incidents to national authorities.
- AI Act: Commission issues draft guidance and reporting template on serious AI incidents
Derived: Probable The General Scheme of the Regulation of Artificial Intelligence Bill 2026, published by Ireland's Department of Enterprise, sets out draft heads for a national AI register, serious-incident reporting and contravention notices.
Evidence and sources
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Head 37 - National Register and Reporting Obligations To provide that: (1) The Office shall establish and maintain a national register of: a. all instances of prohibited AI practices under Article 5; b. High-risk AI systems referred to in point 2 of Annex III.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Head 42 - Serious incidents To provide that: (1) Relevant Market Surveillance Authorities will receive reports of serious incidents from providers of High-Risk AI (HRAI) systems where the incident occurred.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Head 55 - Contravention notice To provide that: (1) An authorised officer who is of the opinion that a person or entity is contravening or has contravened any provision of this Act or the AI Act may service a notice (in this Act referred to as a 'contravention notice') on the person or entity.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026