Skip to content

Knowledge base · AI in HR

What do we do if a high-risk AI system for HR does not work properly or causes a serious incident?

From 2 December 2027 you monitor its operation on the basis of the instructions for use. If you have reason to consider that using it may present a risk, you inform the provider or distributor and the market surveillance authority without undue delay and suspend the use. You report a serious incident immediately, first to the provider and then to the importer or distributor and the market surveillance authority; the provider also reports it itself to the market surveillance authority.

Prepare; applies from 2 December 2027Trusq editorial · checked against the official textLast verified:

Next step: Record your HR AI tools in Trusq

Monitoring and intervening

You monitor the operation on the basis of the instructions for use. If use in accordance with those instructions may present a risk, you inform the provider or distributor and the market surveillance authority and suspend the use. If you identify a serious incident, you immediately inform first the provider, and then the importer or distributor and the market surveillance authority [1]. For HR systems these duties apply from 2 December 2027 [2].

What a serious incident is

An incident or malfunctioning that directly or indirectly leads to, among other things, an infringement of obligations intended to protect fundamental rights [3]. In HR that can be, for example, a system that structurally scores candidates lower on the basis of origin or sex.

What the provider does

The provider reports serious incidents to the market surveillance authority [4], immediately after establishing a causal link and at the latest 15 days after the provider or the deployer becomes aware of it [5]. Your prompt report to the provider is therefore needed to meet that deadline.

Arrange now

Agree with the supplier how you report deviations and incidents, and who in your organisation has the authority to stop the use.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Use per instructions and monitoring AI Act 26, AI Act 73

Sources

  1. [1] AI Act Art. 26(5), first subparagraph (AI Act, Regulation (EU) 2024/1689). Deployers monitor, report risks and suspend the use; they report a serious incident immediately, first to the provider and then to the importer or distributor and the market surveillance authority.
    Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident.
    Source, retrieved on 3 October 2026.
  2. [2] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 3 October 2026.
  3. [3] AI Act Art. 3(49) (AI Act, Regulation (EU) 2024/1689). Definition of serious incident, including an infringement of obligations intended to protect fundamental rights.
    ‘serious incident’ means an incident or malfunctioning of an AI system that directly or indirectly leads to any of the following: (a) the death of a person, or serious harm to a person’s health; (b) a serious and irreversible disruption of the management or operation of critical infrastructure; (c) the infringement of obligations under Union law intended to protect fundamental rights;
    Source, retrieved on 3 October 2026.
  4. [4] AI Act Art. 73(1) (AI Act, Regulation (EU) 2024/1689). Providers report serious incidents to the market surveillance authorities.
    1. Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.
    Source, retrieved on 3 October 2026.
  5. [5] AI Act Art. 73(2) (AI Act, Regulation (EU) 2024/1689). The report follows immediately and at the latest 15 days after becoming aware.
    2. The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident.
    Source, retrieved on 3 October 2026.

Related questions

What duties do we have from December 2027 as a deployer of a high-risk HR system?What does human oversight of a high-risk AI system for HR mean in practice?What do we agree with the supplier of an AI tool for HR?

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.