EU AI Act Art. 72 — Post-market monitoring by providers
Article 72 keeps high-risk AI honest after launch: providers must run a documented post-market monitoring plan that collects and analyses performance data across the system's whole lifetime.
At a glance
What this article requires
- Providers must establish a post-market monitoring system and document it in a plan.
- The plan is part of the technical documentation (Art. 11 / Annex IV).
- It covers performance, drift, and interaction with other AI systems across the lifecycle.
- Data collected feeds back into risk management (Art. 9) and incident handling.
- Deployers must cooperate and report — the provider depends on field data.
Scope
Who this applies to
Providers of high-risk AI own the plan; deployers supply operational data and report incidents, so it is effectively a joint duty in practice.
Obligations
What you must actually do
Write the monitoring plan
Include indicators, collection methods, frequency, and owners, and keep it inside the technical documentation.
Collect and analyse
Systematically gather performance and interaction data, watch for drift and degradation, and feed findings back into the risk register.
Cooperate with deployers
Put data-sharing terms in contracts so the field data actually reaches you.
Action plan
Practical first steps
- 1
Design monitoring indicators during development, not after launch.
- 2
Schedule periodic reviews and tie them to the QMS (Art. 17) and risk management (Art. 9).
- 3
Automate drift alerts where possible — post-market monitoring should not depend on memory.
Penalty exposure
Post-market monitoring failures sit in the general tier: up to €15 million or 3% of global annual turnover.
FAQ
Questions about Art. 72
What is the difference between Art. 9 risk management and Art. 72 post-market monitoring?
Art. 9 is the continuous risk process across the lifecycle; Art. 72 is the specific operational mechanism for collecting and analysing real-world performance data after deployment. They are designed to feed each other.
Do I need a separate plan per system?
Yes — the post-market monitoring plan should be specific to each high-risk system (or closely related families), and it forms part of that system's technical documentation.
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.