Post-market monitoring and continuous improvement of AI: how to watch your systems once live
Launching an AI system is not the end of the work: it is the start. Models degrade, data changes and uses appear that nobody foresaw. Post-market monitoring is the orderly way to find out in time and improve.
What the AI Act says
- Art. 72, post-market monitoring: providers of high-risk systems must set up a proportionate system to collect and analyze data on the system’s performance throughout its lifetime. It forms part of the technical documentation.
- Art. 73, serious incidents: the provider must report a serious incident to the authority after establishing the link with the system, and within 15 days at most. The deadline drops to 2 days for a widespread infringement or a serious incident in critical infrastructure, and to 10 days in case of death.
- Art. 26, deployers: must monitor operation according to the instructions for use and inform the provider and the authority if they identify risks or serious incidents.
Even if you are only a user of a system, monitoring it is what lets you meet your part. More on how to react in AI incidents.
What to watch
- Answer quality: hits, errors and hallucinations in a sample reviewed by people.
- Drift: changes in data or behavior that make the model perform worse than on launch day.
- Fairness: whether results differ unjustifiably between groups of people.
- Complaints from users or affected people.
- Actual use: who uses it, for what, and whether it strays from the intended purpose.
- Incidents and near misses, even when they are not serious.
A simple continuous improvement cycle
- Define indicators with an alert threshold for each system (for example, a maximum share of incorrect answers in the sample).
- Measure at fixed intervals: monthly or quarterly depending on risk.
- Analyze and decide: fix, retrain, restrict use or retire?
- Record the finding, the decision and who made it.
- Report to management with a periodic review of results and risks.
- Update the inventory, classification and documentation if anything changes.
How it fits with ISO 42001
ISO/IEC 42001 follows a “plan, do, check, act” logic: performance evaluation (measuring, internal audit and management review) and improvement (correcting and improving continually) are central parts. If you are working towards it, this monitoring is part of that path; see the certification checklist and the article on internal AI audits.
Common mistakes
- Measuring once, at launch, and never looking again.
- Indicators with no threshold or owner: nobody acts when they drift.
- Not keeping evidence of the reviews.
- Leaving monitoring to the technical team alone, without it reaching management.
Frequently asked questions
Is it mandatory if my system is not high-risk?
Art. 72 applies to high-risk systems. But monitoring any system that affects people or decisions is good practice and makes it easier to show diligence.
How often should I review?
It depends on risk and speed of change. Monthly for sensitive systems, quarterly or half-yearly for the rest.
What is a serious incident?
Broadly, one that causes or may cause death or serious harm to health, critical infrastructure, fundamental rights or property. The exact definition is in Art. 3 of the Regulation.
Informational content, not legal advice. AI regulation changes quickly: always check the current official text before deciding. Information reviewed as of October 15, 2026.
This gives you the method. If you want the finished template: Drift Detection and Monitoring.
What's your Data Governance maturity?
Free assessment with your priority gaps, plus the self-assessment quiz and savings calculator on the Data Governance path.