EU AI Act Article 79 — Procedure for AI Systems Presenting a Risk

What Article 79 actually requires

Article 79 of Regulation (EU) 2024/1689 sets the procedure at national level for handling AI systems that present a risk. It is the operational backbone of EU AI Act market surveillance.

Reg text — Article 79(1): "AI systems presenting a risk shall be understood as a 'product presenting a risk' as defined in Article 3, point (19) of Regulation (EU) 2019/1020, insofar as they present risks to the health or safety, or to fundamental rights, of persons."

The procedure

When the market surveillance authority of a Member State has sufficient reason to consider that an AI system presents a risk, it carries out an evaluation against the requirements of the Regulation (Article 79(2)). If during the evaluation the authority finds the system does not comply, it requires the relevant operator (provider, deployer, importer, distributor, authorised representative) to take all appropriate corrective actions to bring the system into compliance, withdraw it from the market, or recall it within a prescribed period.

If the operator does not take adequate corrective action within the period, the authority takes all appropriate provisional measures to prohibit or restrict the AI system being made available on its national market or service, withdraw it, or recall it (Article 79(5)).

The authority informs the Commission and the other Member States without delay. Where there is disagreement, the Commission may take its own measures.

Severity classification — Article 3(49)

Article 3(49) defines a serious incident: any incident or malfunctioning of an AI system that directly or indirectly leads to:

• (a) the death of a person, or serious damage to a person's health;
• (b) a serious and irreversible disruption of the management or operation of critical infrastructure;
• (c) the infringement of obligations under Union law intended to protect fundamental rights;
• (d) serious damage to property or the environment.

Article 73 then sets reporting timelines:

• 15 days generally from the moment a serious incident is identified.
• 72 hours for incidents involving infringement of Union fundamental-rights law.
• 10 days for incidents involving the death of a person.

Who is covered

Providers, deployers, importers, distributors, and authorised representatives. Both Article 26(5) (deployers) and Article 73 (providers) trigger the Article 79 procedure.

What to do

• Maintain an internal severity-classification triage tree that maps observed events to Article 3(49) categories. Document the decision criteria.
• Bind the triage to a stop-the-line procedure: a designated decision-maker can halt deployment within hours, not days.
• Maintain a serious-incident register linked to your Article 9 risk register.
• Pre-prepare the Article 73 reporting forms for each Member State you operate in.
• Train staff on the 72h/10d/15d windows. Missing a 72-hour window because the responsible person was on leave is a material non-conformity.

Inline crosswalk

• ISO/IEC 42001:2023 Clause 10.2 — Nonconformity and corrective action.
• NIST AI RMF MANAGE 2.3 — Procedures to respond to and recover from a previously unknown risk.
• NIST AI RMF MANAGE 4.3 — Incidents and errors communicated to relevant AI Actors.

Common mistakes

• No documented severity-classification decision tree.
• No 24/7 on-call rotation; missing the 72h window.
• Reporting only to the home Member-State authority and missing other Member States where the system is in use.
• No internal record of the operator's view of the incident — what was investigated, what was concluded, what was changed.

Penalties

Failure to comply with Article 79 corrective measures is treated under Article 99 as non-compliance with the obligations of operators under Chapter III — up to €15 million or 3% of worldwide annual turnover.

---

Disclaimer. Reference; not legal advice. Verify with counsel. Reg text from Regulation (EU) 2024/1689.