Post-Market Monitoring Under the EU AI Act (Article 72): Requirements and Implementation (2026)

Article 72 Requirements

The EU AI Act establishes mandatory post-market monitoring for providers of high-risk AI systems. Article 72 requires providers to establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system.

Post-Market Monitoring Plan

Providers must establish a post-market monitoring plan as part of the technical documentation required under Article 11. The plan should cover the following elements.

Plan Components

• Identification of data to be collected and monitored
• Methods for data collection and analysis
• Frequency and timing of monitoring activities
• Criteria and thresholds for triggering corrective actions
• Procedures for communication with market surveillance authorities
• Mechanisms for collecting feedback from deployers and affected persons

Data Collection Requirements

Article 72(2) specifies that the post-market monitoring system shall actively and systematically collect, document, and analyze relevant data. Sources include the following.

Relationship to Conformity Assessment

Post-market monitoring feeds into the ongoing conformity assessment process. If monitoring reveals that the AI system no longer meets the essential requirements of the EU AI Act, the provider must take corrective actions. Significant changes may trigger a new conformity assessment.

Serious Incident Reporting

Article 73 complements post-market monitoring with specific serious incident reporting obligations. Providers and deployers must report serious incidents to market surveillance authorities. The post-market monitoring system should be designed to detect serious incidents promptly.

Serious Incident Definition

A serious incident is an incident or malfunction that directly or indirectly leads to death or serious damage to health, property, or the environment, or a serious and irreversible disruption of critical infrastructure management.

Implementation Steps

1. Map all high-risk AI systems subject to Article 72
2. Identify data sources for each system
3. Design data collection mechanisms (automated and manual)
4. Define performance thresholds and alert criteria
5. Establish analysis procedures and reporting workflows
6. Document the post-market monitoring plan
7. Integrate the plan into technical documentation
8. Train relevant personnel on their monitoring responsibilities
9. Test the monitoring system before deployment
10. Review and update the plan at defined intervals

Deployer Obligations

While the primary monitoring obligation falls on providers, deployers of high-risk AI systems also have responsibilities. Deployers must monitor the operation of the AI system based on the instructions of use and inform the provider about any risks and serious incidents they become aware of.

Documentation and Record-Keeping

All monitoring data, analysis results, and actions taken must be documented and retained. Article 18 requires that technical documentation (which includes the post-market monitoring plan) be kept for 10 years after the AI system is placed on the market or put into service.

Integration with Quality Management

The post-market monitoring system should be integrated with the provider's quality management system required under Article 17. This integration ensures that monitoring findings feed into the continuous improvement cycle and that corrective actions are tracked through established quality processes.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.