Under the EU AI Act, providers of high-risk AI systems must run a documented post-market monitoring system that collects and analyses performance data across the system's lifetime (Article 72). It sits inside the quality management system (Article 17) and feeds incident reporting. Passing conformity assessment is the starting point, not the end.
What does Article 72 require?
According to the text on artificialintelligenceact.eu, providers must establish and document a monitoring system proportionate to the nature and risks of the AI. It must actively and systematically collect, document and analyse data on performance throughout the system's lifetime, from deployers or other sources, to check continued compliance with the Chapter III Section 2 requirements. Where relevant, the analysis covers interaction with other AI systems.
The system must follow a post-market monitoring plan, which is part of the Annex IV technical documentation. The Commission is to adopt an implementing act with a template. That page shows two versions of the deadline for the template, so check the official text for the current date.
How does it connect to the quality management system?
Article 17 lists the elements of the quality management system a provider must document. Two are directly relevant: a post-market monitoring system in line with Article 72, which collects and reviews real-world experience to act on corrective or preventive measures, and procedures for reporting serious incidents under Article 73. Others, such as data management, risk management, record keeping and accountability, supply the inputs. Article 17 also says the scale of measures may fit the provider's size, but the level of rigour stays the same.
When does this apply?
The European Commission's AI Act page lists 2 August 2026 as the date the main body of the Act applies, and 2 December 2027 and 2 August 2028 as the dates for high-risk obligations under Annex III and Annex I respectively, following the AI Omnibus amendments that entered into force on 27 July 2026. Dates have moved, so confirm against the Official Journal before planning.
This post explains the regulation. Safeguard does not certify AI Act compliance, and no tool can do that for you.
What belongs in a monitoring plan?
A plan is easier to run when it answers six plain questions.
- What are we measuring? Accuracy, error types, drift, complaints and overrides, tied to the requirements the system must keep meeting.
- Where does the data come from? Logs, deployer feedback, user reports, and third party sources.
- Who reviews it, and how often?
- What triggers action? Name thresholds for retraining, rollback or a notice to deployers.
- How do serious incidents get escalated? Link the plan to the Article 73 procedure.
- What gets recorded? Keep the reviews and decisions in your technical documentation.
What to do
- Write the plan now and attach it to the technical documentation.
- Instrument the system to log inputs, outputs and human overrides in a way you can analyse without exposing personal data unnecessarily.
- Set a quarterly review with product, engineering, legal and security.
- Track the AI supply chain. Model versions, datasets and third party components change, and an AI bill of materials makes those changes visible.
- Test the incident path with a tabletop exercise.
- Record changes and re-check the requirements after each material update.
Quick check
Is post-market monitoring optional for high-risk AI?
No. Article 72 requires providers of high-risk AI systems to establish and document it, and Article 17 includes it in the quality management system.
Where does the monitoring plan live?
It forms part of the Annex IV technical documentation, according to Article 72.
Sources
- Article 72, Post-market monitoring
- Article 17, Quality management system
- European Commission, AI regulatory framework and timeline
Last reviewed: 18 October 2026.
