AI System Monitoring Under the EU AI Act: Post-Market Monitoring Under Article 72

Article 72 requires providers of high-risk AI systems to establish a post-market monitoring system. This system must actively and systematically collect, document and analyse data on the performance of the AI system throughout its entire lifecycle. It must be proportionate to the nature of the AI system and its risk level. A documented monitoring plan forms part of the technical documentation under Annex IV.

High-risk AI systems must have automatic logging capabilities. The following must be recorded: periods of use, input data leading to matches, reference databases used, and the identity of verifying persons. Deployers must retain these logs for at least six months. The logs serve traceability and form the basis for regulatory inspections.

Serious incidents (events causing death, health damage or significant fundamental rights violations) must be reported to the competent market surveillance authority within 15 days of becoming aware. The deadline is shortened in cases of imminent danger. Providers must establish a clear escalation process to ensure timely reporting.

Post-market monitoring under Art. 72 is the systematic collection and analysis of data after placing on the market, an obligation of the provider. Human oversight under Art. 14 means that natural persons can effectively oversee the AI system during operation and intervene when necessary, an obligation of the deployer. The two concepts complement each other: monitoring provides the data, human oversight enables the response.

AI monitoring and GDPR overlap significantly: Data Protection Impact Assessments under Art. 35 GDPR complement AI risk assessments, and monitoring data may contain personal data. For financial institutions, DORA adds ICT risk management and incident reporting requirements. An integrated monitoring strategy covering the AI Act, GDPR and DORA avoids duplication and gaps.

The obligations are shared. Providers must establish the post-market monitoring system, document the monitoring plan and report serious incidents. Deployers must ensure ongoing operational monitoring, retain logs and report notable risks to providers and authorities. In practice, this requires clear contractual arrangements between provider and deployer.

ISO/IEC 42001 provides an AI management system framework as a foundation. The final draft ISO/IEC FDIS 24970 (as of May 2026) standardises AI system logging under Article 12. The European Commission is developing harmonised standards specifically for post-market monitoring. Existing IT monitoring frameworks such as ITIL and ISO 27001 can serve as a starting point and be extended with AI-specific requirements.