In short
- Article 72 requires providers of high-risk systems to establish and document a post-market monitoring system proportionate to the technology and its risks.
- The monitoring plan is not a separate artefact. Annex IV point 9 makes it part of the technical documentation, so a missing plan is a gap in the technical file.
- The duty is to collect, document and analyse data across the entire lifetime of the system, which is a longer window than any evaluation covers.
- Post-market monitoring feeds Article 73. It is the mechanism by which a provider becomes aware of a serious incident, and awareness starts the 2 to 15 day clocks.
- Regulation (EU) 2026/1744 replaced Article 72(3): there will be no binding Commission template, only guidance with a voluntary template due by 2 September 2027.
- For Annex III systems the obligation applies from 2 December 2027, which leaves 91 days between that guidance and the date the system must exist.
Post-market monitoring is the obligation teams believe they already meet, because there is a dashboard.
The text asks for something else: a documented system, based on a plan, that runs for the life of the product.
01What does Article 72 require?
Active and systematic collection, across the whole lifetime.
Providers of high-risk systems must establish and document a post-market monitoring system, proportionate to the nature of the AI technologies and to the risks of the system. That system must actively and systematically collect, document and analyse relevant data on performance throughout the lifetime of the system, and it must be based on a post-market monitoring plan.
Three words carry the weight. Documented rules out an informal practice. Systematic rules out looking when someone complains. Lifetime rules out a validation exercise that stopped at launch.
Paragraph 3 of Article 72 no longer reads as it did when the AI Act was published. Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced it on 27 July 2026, and the replacement matters to anyone waiting for instructions: the Commission’s power to impose a template by implementing act is gone, and in its place is a duty to publish guidance, including a template, by 2 September 2027.
02Why is the plan part of the technical file?
Because Annex IV says so, and that changes who reads it.
| Artefact | Where it sits | Consequence |
|---|---|---|
| Monitoring system description | Annex IV point 9 | Inspected with the technical file |
| Monitoring plan | Annex IV point 9 | A missing plan is a file gap |
| Collected performance data | Article 72 | Must exist for the whole lifetime |
| Resulting corrective action | Article 73(6) | Evidence the loop closed |
A team that treats monitoring as an operational concern and the technical file as a compliance concern will produce two documents that disagree. The file describes an intended monitoring approach and operations runs something else, which is the discrepancy an auditor asks about first.
03What belongs in the plan?
Enough that someone else could operate it.
| Element | Weak version | Defensible version |
|---|---|---|
| What is collected | Model metrics | Named metrics, 1 owner each |
| How often reviewed | Regularly | Monthly, with a dated record |
| Thresholds for action | If performance degrades | Numeric trigger per metric |
| Escalation route | Raise with the team | Named role, Article 73 assessment |
| Retention | Not stated | Aligned to the 10 year file |
The third row is where most plans are thin. Without a numeric trigger there is no moment at which monitoring produces a decision, and a monitoring system that never produces a decision is indistinguishable from no monitoring at all.
Waiting for the official version is not a plan either. The guidance promised in Article 72(3) is due by 2 September 2027, which is 91 days before the Annex III obligation applies, and the recital behind the change says the point of dropping the binding template was to let providers tailor monitoring to their own organisation. A plan written against Article 72 now is the version that will carry the Annex III deadline, whatever the guidance later suggests.
04How does it connect to incident reporting?
It is how awareness happens, and awareness starts the clock.
Article 73 deadlines run from the point at which the provider becomes aware of a serious incident. Post-market monitoring is the designed route to that awareness. An organisation whose first knowledge of a problem is a customer complaint has not avoided the deadline; it has started it later, in circumstances where the delay is documented by someone else.
That is the argument for numeric triggers rather than review meetings. A threshold breach is a timestamp. A meeting is a recollection.
05What can be done before the obligation applies?
Start collecting, because the data cannot be created retrospectively.
The Annex III date of 2 December 2027, set by Article 113 as replaced by Regulation (EU) 2026/1744, is when the system must exist and be demonstrable. The deferral moved that date and left the rest of the calendar alone, so the extra time is time to collect data rather than time before anyone needs it. Performance data covering the period before that date is what makes the demonstration possible, and it is the one input that cannot be assembled in the final quarter.
A minimal version, running now, beats a complete version designed in 2027: three metrics, a monthly review with a date, and a written threshold for each. Everything else can be added once the habit exists.
06Frequently asked questions
What is post-market monitoring under the AI Act?
A documented system by which a provider of a high-risk AI system actively and systematically collects, documents and analyses data on the system's performance throughout its lifetime, so that continuing compliance can be evaluated.
Is a monitoring dashboard enough?
No. The obligation is for a documented system based on a plan, not for telemetry. A dashboard shows current state; the plan states what will be collected, how often it is reviewed, by whom, and what triggers action.
Where does the monitoring plan live?
In the technical documentation. Annex IV point 9 requires a description of the post-market monitoring system and the plan as part of the file, which means it is inspected alongside the design and evaluation material rather than separately.
Is there an official template for the monitoring plan?
Not yet, and it will not be binding when it arrives. Regulation (EU) 2026/1744 removed the Commission's power to impose a template by implementing act and replaced it with a duty to publish guidance, including a voluntary template, by 2 September 2027. A provider designing a plan now is designing the only version that will exist for most of the run-up.
How does post-market monitoring relate to incident reporting?
It is the upstream mechanism. Article 73 deadlines run from the moment a provider becomes aware of a serious incident, and monitoring is how awareness happens. Weak monitoring does not stop the clock, it just means it starts late and visibly.
07References and method
- Regulation (EU) 2024/1689, Article 72, for the post-market monitoring system, its proportionality standard and the requirement that it be based on a plan.
- Regulation (EU) 2024/1689, Annex IV point 9, for the inclusion of the post-market monitoring system and plan in the technical documentation.
- Regulation (EU) 2024/1689, Article 73, for the serious incident reporting deadlines that awareness triggers.
- Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. Point (30) replaces Article 72(3), removing the implementing act empowerment and requiring Commission guidance, including a template, by 2 September 2027.
- Regulation (EU) 2026/1744, point (40), replacing Article 113, third paragraph, point (c), for the application dates of 2 December 2027 under Article 6(2) and Annex III and 2 August 2028 under Article 6(1) and Annex I. Read against the operative text on 18 September 2026.
- Regulation (EU) 2024/1689, Article 18(1), for the 10 year period over which the technical documentation is kept at the disposal of national competent authorities.