EU AI Act How do you monitor AI after release?

Providers must establish and document monitoring proportionate to the system's technology and risks. Actively and systematically collect, record and analyse relevant performance data throughout its lifetime.

Keep the post-market monitoring plan in the Annex IV technical documentation. The 2026 amendment replaces the earlier implementing-act mechanism with Commission guidance and a template, due by 2 September 2027. It was published on 24 July 2026 and entered into force on 27 July. Until the guidance is available, you can use your own or a vendor's form to organise evidence; identify it as that form.

For high-risk systems already covered by Section A of Annex I product legislation, Article 72 allows the provider to integrate equivalent AI Act elements into an existing sectoral post-market system and plan. The same integration option applies to Annex III point 5 systems placed on the market or put into service by financial institutions subject to Union financial-services governance rules.

Deployers monitor use according to the provider's instructions and, where relevant, inform providers under Article 72. They supply important evidence even though the provider owns the plan.

If instructed use may create an Article 79(1) risk to health, safety or fundamental rights, the deployer must suspend use and inform the provider or distributor and relevant market surveillance authority without undue delay. For a serious incident, immediately inform the provider first, then the importer or distributor and relevant authorities. If the provider cannot be reached, apply Article 73 with the necessary role adjustments. The notification duty excludes sensitive operational data of law-enforcement deployers.

Give ordinary feedback, nonconformity, risks and serious incidents separate handling routes. Under Article 20, a provider that considers or has reason to consider a high-risk system nonconforming must immediately bring it into conformity, withdraw it, disable it or recall it, as appropriate.

Keep the plan, signals collected, analysis, decisions and documentation updates together. A reviewer should be able to see why a signal did or did not lead to corrective action, a conformity update or an incident report.

Annex IV requires a description of relevant lifecycle changes and the performance-evaluation system, including the Article 72 plan. Keep the change history with the monitoring records.

Review the plan when the deployed system no longer matches its instructions, documentation or risk assumptions. Check changes to purpose, classification, performance, affected groups, oversight, logs, integrations and controls.

Review responsibility too. A distributor, importer, deployer or other party can become the provider by rebranding a high-risk system, substantially modifying one while it remains high-risk, or changing a non-high-risk system's purpose so it becomes high-risk. Record the applicable Article 25 trigger and any contractual allocation for rebranding.