Post-market monitoring
Article 72 requires providers of high-risk AI to run a documented plan that actively and systematically collects and reviews real-world performance data after the system is on the market.
Providers must establish a post-market monitoring system proportionate to the nature of the AI technologies and the risks of the high-risk system, based on a post-market monitoring plan that forms part of the Annex IV technical documentation. It actively and systematically collects, documents and analyses relevant data on performance throughout the system's lifetime — data that may be provided by deployers or collected through other sources — and allows the provider to evaluate continuous compliance with the Chapter III requirements. The Commission is empowered to adopt a template for the plan.
- Art. 72
- Art. 9
- Art. 73
- Annex IV
Post-market monitoring: why it matters
Post-market monitoring is what makes AI Act compliance a permanent operating cost rather than a launch project. It is the mechanism that detects drift, degradation and unexpected sub-population failures, and it is the input that legally must flow back into the Article 9 risk analysis and, where thresholds are crossed, into an Article 73 incident report. The plan also has to be written before launch, because it is part of the technical documentation the conformity assessment reviews.
Post-market monitoring in practice
A provider of a medical triage system tracks accuracy by age band, hospital and specialty every month against the metrics declared in its documentation. Six months in, sensitivity for patients over 80 has degraded three points at two sites. That finding does not need to become an incident report, but it does need to enter the risk-management file, trigger investigation, and — if the risk is no longer acceptable — corrective action and notification to deployers.
Post-market monitoring: the mistake people make
Equating post-market monitoring with uptime and latency dashboards. Article 72 is about whether the system still meets its Chapter III requirements in the field — accuracy, robustness, bias, oversight effectiveness — which means metrics that reflect outcomes for affected people, broken down by the groups the risk analysis identified.
Post-market monitoring: common questions
- Is a post-market monitoring plan mandatory?
- Yes, for high-risk AI systems. The plan is part of the Annex IV technical documentation, so it must exist before the system is placed on the market rather than being written after launch.
- What data does post-market monitoring collect?
- Relevant data on the system's performance throughout its lifetime, including data deployers provide, sufficient for the provider to evaluate continuous compliance with the requirements in Chapter III, Section 2.
- How does monitoring relate to incident reporting?
- Monitoring is continuous and internal; incident reporting under Article 73 is triggered when a serious incident is identified. Monitoring is usually how the provider learns that a reportable incident occurred.
Post-market monitoring: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.