Post-market monitoring

An AI system can behave well in testing and badly in the real world. That is why Article 72 requires providers of high-risk systems to have a post-market monitoring system.

It means actively collecting, documenting and analysing data on the system's performance throughout its life (deployers can supply it), to check that it keeps meeting the requirements. It must be based on a monitoring plan that forms part of the technical documentation; the Commission publishes an official template.

Findings feed into risk management and, if a serious incident arises, into notification to the authority. In practice it relies on technical monitoring: accuracy metrics, drift detection and user complaints.