Module 6 — Incidents, Complaints and Whistleblowing

Module 6 of the AI Act Compliance certification: the Art. 26(5) suspension duty, Art. 73 serious incident reporting, the Art. 85 complaint right, Art. 87 whistleblower protection, and market surveillance powers.

Compliance programmes are usually built around obligations flowing outward. This module is about the routes flowing in: how a problem reaches a regulator, and what has to happen inside the organisation when it does.

Two internal triggers

Art. 26(5) — the deployer's suspension duty. Where a deployer has reason to consider that use of a high-risk system in accordance with the instructions may present a risk within the meaning of Art. 79(1), it shall without undue delay inform the provider or distributor and the relevant market surveillance authority, and suspend use.

Three features worth naming for a compliance officer:

• The threshold is "reason to consider ... may present a risk" — not confirmation, not proof.
• Suspension is not optional, and operationally comes first.
• The trigger is risk from use in accordance with the instructions. Risk from use outside them is an Art. 26(1) failure and probably an Art. 25 problem.

Art. 20 — the provider's corrective action duty. A provider that considers, or has reason to consider, that a system it placed on the market is not in conformity must immediately take corrective action — bring it into conformity, withdraw, disable or recall — and inform distributors and, where applicable, deployers, the authorised representative and importers. Where the system presents a risk, it must immediately investigate and inform the market surveillance authorities and, where applicable, the notified body.

Both thresholds are low, and both are the kind of decision that stalls without a named owner and a pre-agreed procedure. That is the compliance function's contribution: not making the call, but ensuring the call can be made at 2 a.m. by someone who knows they are allowed to.

Art. 73 — serious incident reporting

The duty sits on the provider, reporting to the market surveillance authority of the Member State where the incident occurred.

A serious incident is defined by consequence: death or serious harm to health; serious and irreversible disruption of the management or operation of critical infrastructure; infringement of obligations under Union law intended to protect fundamental rights; or serious harm to property or the environment.

That third limb is the one compliance officers should flag internally, because engineering teams read "incident" as "accident". Systematically discriminatory output, with no physical harm at all, can be a serious incident.

Timing. Immediately after establishing a causal link, or the reasonable likelihood of one, and in any event not later than 15 days after becoming aware. Shorter deadlines apply to the gravest categories — widespread infringement, serious and irreversible disruption of critical infrastructure, and death. Where the causal link is not yet established, the initial report is still made within the deadline.

After reporting, the provider performs the necessary investigations including a risk assessment and corrective action, cooperates with the authorities and, where relevant, the notified body — and must not alter the system in a way that may affect subsequent evaluation of the causes before informing the authorities. That constraint runs against every engineering instinct, and it belongs in the incident runbook rather than in a policy nobody reads at the time.

The handover. If you deploy, your Art. 26(5) notification is what starts the provider's Art. 73 clock. If you provide, you cannot report what your deployers have not told you. Contractual notification commitments with stated timeframes are what make the two duties connect, and they belong in the procurement gate.

Art. 85 — the right to lodge a complaint

Any natural or legal person having grounds to consider that there has been an infringement of the Regulation may submit a complaint to the relevant market surveillance authority, which handles it in accordance with its dedicated procedures.

Three consequences for a programme.

Expect the route to be used. It is low-friction, it requires no standing beyond grounds to consider, and it is available to competitors as well as to affected individuals.

Your internal complaint channel is not a substitute, but it is a mitigation: a person whose concern is answered well internally is less likely to escalate, and an organisation that can show it answered is in a better position when they do.

Keep the log. Complaints received, when, about what, what you concluded, what changed. It is one of the few artefacts that demonstrates a programme responding rather than merely existing.

Art. 87 — reporting of infringements and protection of reporting persons

Directive (EU) 2019/1937 applies to the reporting of infringements of the AI Act and to the protection of persons reporting them.

For an organisation already within the scope of the whistleblower directive, this is largely a scoping question rather than a new build: the internal reporting channel, the acknowledgement and feedback timeframes, the confidentiality requirements and the prohibition on retaliation extend to AI Act matters.

Two practical points.

Tell people it applies. A channel nobody knows covers AI concerns will not receive them, and concerns that do not surface internally surface elsewhere.

Retaliation is the risk that materialises. The commonest failure is not the absence of a channel but a reporting person experiencing consequences — reassignment, exclusion from a project, a poor review — that are hard to distinguish from ordinary management decisions. That is a people-process control, not a compliance document.

Market surveillance powers, briefly

AI systems are supervised by the national market surveillance authority designated by each Member State, operating within the Union market surveillance framework. Its powers include requesting information and documentation, and in defined circumstances access to source code, subject to safeguards.

Where a system presents a risk, the authority may require corrective action, restrict or prohibit making it available, or require withdrawal or recall.

GPAI models are supervised centrally by the Commission through the AI Office, with the power to request documentation and information, to conduct evaluations of models, to require measures, and to impose fines under Art. 101.

What that means practically: the organisation should know which authority supervises it for which systems, and who is authorised to respond. An information request answered inconsistently by two teams is a worse start than a slow answer from one.

The runbook

One document, per organisation, covering:

1. Detection — from monitoring, from a user, from a complaint, from a whistleblower report.
2. Triage — is this an Art. 26(5) risk, an Art. 20 non-conformity, an Art. 73 serious incident, a GDPR personal data breach, or several at once.
3. Suspension — who can pull the switch, what happens to work in flight, what the fallback is.
4. Notification — templates, recipients, clocks, and the prohibition on altering the system first.
5. Investigation — with a note that the AI Act clock does not pause for it.
6. Record — what happened, what was decided, what changed.

Tested at least once. A runbook that has never been executed is a document.

Check yourself

1. Nobody was hurt, so it is not a serious incident. — Infringement of Union law obligations intended to protect fundamental rights is one of the limbs. Discriminatory output can qualify.
2. We fixed the defect, then notified. — Art. 73 prohibits altering the system in a way that may affect subsequent evaluation of the causes before informing the authorities.
3. A competitor cannot complain about our AI system. — Art. 85 gives any natural or legal person with grounds to consider an infringement the right to complain.
4. Our whistleblowing channel is for financial matters. — Art. 87 applies Directive (EU) 2019/1937 to AI Act infringements. Say so, or the reports will go elsewhere.

Previous: Module 5 — AI Act and GDPR together Next: Module 7 — The audit file and the board conversation →