Post-market monitoring: the Art. 72 plan and the monitoring cycle
After deployment the work continues: a monitoring plan per high-risk system, recurring reviews on Assessments, and the paper trail that connects field experience back into risk management.
Obligations, filtered to the Monitoring & incidents domain, tracks Article 72: providers of high-risk systems must establish and document a post-market monitoring system proportionate to the nature of the AI technologies and the risks — actively and systematically collecting, documenting and analysing data on the system's performance throughout its lifetime, and feeding it back into the risk-management system.
This is the Monitor phase of the six-phase compliance journey — the phase that never really closes, by design.
The monitoring plan
Each high-risk system carries monitoring-plan obligations: what data you collect (performance metrics, drift signals, user feedback, complaints), how often you review it, the thresholds that trigger action, and who is responsible. Work them in the drawer like any obligation — checklist, fields, evidence, owner. The plan belongs in the Annex IV technical documentation, and the composed editor pulls it from what you record here.
A deployer that is a financial institution subject to internal governance requirements under Union financial-services law is deemed to meet its own Art. 26(5) monitoring duty by complying with those arrangements; the drawer's reuse card records that reliance, and changes nothing else.
The recurring cycle
Monitoring is a cadence, not a document. Veritome keeps it moving:
- The post-market monitoring review generated at classification carries a due date and reminds its owner as it falls due.
- Completing a review records who and when, creates the next occurrence, and appends a dated entry to the system's classification dossier — so the chain of custody shows monitoring actually happened, review after review.
- Findings that need action become Risks or, when serious enough, Incidents.
Where incidents fit
A serious incident (Art. 73) is the sharp end of post-market monitoring — the tiered statutory clocks (2, 10 or 15 calendar days) and authority reporting are covered in Report a serious incident to the right authority. This routine is what makes those rare; the two share the same field data.