Post-market monitoring (Article 72) after deployment

Short answer: Article 72 of the AI Act requires providers of high-risk AI to maintain a post-market monitoring system after market launch. Through it they systematically collect and analyse data on how the system performs in practice throughout its lifetime. Those signals feed back into risk management and can trigger corrective measures. Compliance is therefore not an endpoint at deployment.

Why monitoring after the market

An AI system behaves differently in practice than in the test environment. Usage patterns shift, data changes, and risks not visible up front can still emerge. Article 72 closes that loop: the provider must keep actively checking whether the system still performs as intended and whether the risk estimates still hold. This keeps the pre-market conformity assessment connected to the reality that follows.

What the monitoring system does

The post-market monitoring system must, proportionate to the nature and risks of the system:

• Collect relevant data on the performance of the high-risk system throughout its lifetime.
• Document and analyse that data, including data supplied by deployers.
• Evaluate continuous compliance with the AI Act's requirements based on what happens in practice.

The provider records this in a monitoring plan that forms part of the technical documentation (Annex IV). The Commission provides a template for such a plan.

Feedback to risk management

Post-market monitoring does not stand alone. Findings feed directly into the risk management system (Article 9): new or changed risks that emerge in practice must be re-estimated and mitigated where needed. Where things go wrong, this can lead to an update, a warning to users, or in the extreme a recall.

Relation to incident reporting

Monitoring is broader than incident reporting but linked to it. The AI Act has a separate obligation to report serious incidents to the supervisor. The monitoring system is the structure through which you notice such incidents and broader performance problems in the first place. See also the high-risk obligations overview.

What to do

• Draw up a monitoring plan before the system goes live, not after.
• Collect performance data in a structured way, including signals from deployers.
• Analyse periodically whether the system still performs and complies as intended.
• Feed findings back into risk management and documentation.
• Prepare corrective measures: update, warning or recall.

A high-risk system without monitoring is a blind spot that only becomes visible once harm has already occurred.