EU AI Act post-market monitoring for high-risk AI systems

Article 72 requires providers of high-risk AI systems to establish and document a post-market monitoring system that is proportionate to the AI technologies and risks of the system. The system must actively and systematically collect, document, and analyse relevant data on the high-risk AI system's performance throughout its lifetime.

The monitoring system must be based on a post-market monitoring plan that forms part of the Annex IV technical documentation. Regulation (EU) 2026/1744, published on 24 July 2026 and entering into force on 27 July 2026, replaces the earlier implementing-act mechanism with Commission guidance, including a template, due by 2 September 2027. Until that guidance is available, an internal or vendor form can organise evidence but should not be presented as the Commission template.

For high-risk systems already covered by Section A of Annex I product legislation, Article 72 allows the provider to integrate equivalent AI Act elements into an existing sectoral post-market system and plan. The same integration option applies to Annex III point 5 systems placed on the market or put into service by financial institutions subject to Union financial-services governance rules.

Deployers are not the Article 72 plan owner, but Article 26 makes them important monitoring inputs. Deployers must monitor high-risk AI systems on the basis of the instructions for use and, where relevant, inform providers under Article 72.

If a deployer has reason to consider that use in accordance with the instructions may present a risk under Article 79(1), the deployer must inform the provider or distributor and the relevant market surveillance authority without undue delay and suspend use. If the deployer identifies a serious incident, it must immediately inform the provider first, then the importer or distributor and the relevant market surveillance authorities; if the provider cannot be reached, Article 73 applies mutatis mutandis.

Provider handling should therefore separate ordinary performance feedback from nonconformity, risk, and serious-incident paths. Article 20 requires providers that consider or have reason to consider their high-risk AI system is not in conformity to immediately take corrective action to bring it into conformity, withdraw it, disable it, or recall it as appropriate.

The evidence should show systematic continuing-compliance review as well as incident logging. Keep the plan, monitored signals, analysis records, outcomes, and technical-documentation updates together so a reviewer can trace why a risk signal did or did not trigger corrective action, a conformity update, or a serious-incident report.

Annex IV also expects technical documentation to describe relevant lifecycle changes and the post-market performance-evaluation system, including the Article 72 monitoring plan. That makes change history part of the post-market monitoring evidence set.

Reopen the Article 72 review when the real-world system no longer matches the monitoring plan, instructions for use, technical documentation, or risk-management assumptions. The strongest triggers are changes that affect intended purpose, high-risk classification, performance, affected groups, human oversight, logs, integration context, or risk controls.

A distributor, importer, deployer, or other third party can become the provider for a high-risk AI system if it puts its name or trademark on the system, makes a substantial modification while the system remains high-risk, or modifies the intended purpose of a non-high-risk AI system so it becomes high-risk. Those lifecycle changes should not be treated as ordinary backlog items.