What is post-market monitoring under the EU AI Act?
Post-market monitoring (Article 72) is the provider's obligation to actively and systematically monitor an AI system after it has been placed on the market or put into service. This includes establishing a documented monitoring plan, collecting performance data, identifying risks that emerge during use, and taking corrective action when necessary.
Compliance does not end at market placement. It must be maintained throughout the system's lifetime, and monitoring evidence must be part of the governed record.
Key points
- Providers must establish a post-market monitoring plan proportionate to the system's risk level and nature.
- Monitoring must be active and systematic — not reactive. Waiting for complaints or incidents is not sufficient.
- Performance changes, risk signals, or incident patterns may trigger re-assessment, updated conformity assessment, or corrective action.
- Deployers must cooperate with providers' monitoring activities and share relevant operational data where required.
- Monitoring results feed back into the governance chain and may trigger re-screening of the system's risk classification.
Why it matters
AI systems can degrade, drift, or encounter use contexts not anticipated at deployment. Post-market monitoring creates the governance mechanism to detect these changes and respond before they become compliance failures. Organizations that treat the initial conformity assessment as a permanent state misunderstand the AI Act's lifecycle approach to governance.
How EAB approaches this
EAB's Continuous Compliance framework supports ongoing monitoring. The Re-Screening Queue triggers review when changes are detected. Evidence Readiness tracks whether monitoring evidence remains current. The governance chain preserves the link between initial assessment and any corrective actions taken during the system's lifetime.