Post-Market Monitoring Under the EU AI Act: Definition (Article 72)
Post-market monitoring (EU AI Act Article 72): the provider duty to actively collect and analyse high-risk AI performance data after launch, feeding Article 73.
Post-market monitoring is the obligation on the provider of a high-risk AI system to actively and systematically collect, document, and analyse data on how that system performs after it is placed on the market or put into service — for the whole of the system's lifetime. It is set out in Article 72 of Regulation (EU) 2024/1689 (the EU AI Act). This entry defines the term, summarises what Article 72 requires, and explains how it feeds serious-incident reporting under Article 73; it applies only to high-risk systems.
Post-market monitoring: the short definition
Post-market monitoring is the "keep watching it after launch" duty. Once a high-risk AI system is live, Article 72 requires its provider to keep gathering performance data — not as a one-off launch audit, but continuously, across the system's operational life.
Two features distinguish it. First, it is proactive and continuous: the provider must actively seek out and analyse data, not wait for complaints. Second, it is provider-operated — it is distinct from market surveillance, which is what national authorities do under Articles 74 and following. Monitoring is what you do to your own system; market surveillance is what the regulator does to the market.
The activity is structured by a documented post-market monitoring plan. For a time-pressed reader, the one-line version: it is the mechanism that detects whether a deployed high-risk system still meets the Act's requirements.
What Article 72 requires, in brief
The sub-paragraph-by-sub-paragraph walkthrough lives on the Article 72 full guide. At a high level, Article 72 has three operative elements:
- Establish and document a monitoring system proportionate to the nature of the AI technology and the risks of the system (Article 72(1)).
- Actively and systematically collect, document, and analyse relevant performance data over the system's lifetime (Article 72(2)).
- Base the activity on a documented plan (Article 72(3)).
Data may come from several sources — the deployers using the system, the provider's own telemetry, end users, and other channels. Article 72(2) explicitly contemplates deployer-supplied data.
The post-market monitoring plan is not a stand-alone document. Via Article 11, it forms part of the Annex IV technical documentation. The European Commission is to issue a template for the plan; as of June 2026 that template has not yet been published, so providers draft against the statutory requirements directly.
Where a high-risk system is also covered by other Union law carrying equivalent post-market surveillance duties — medical devices under Regulation (EU) 2017/745, for instance — Article 72(4) allows the monitoring to be integrated into that existing regime rather than duplicated.
One honesty note on scope. Article 72 applies only to high-risk AI systems. Most marketing and adtech tools, and general logistics AI, are not high-risk and carry no Article 72 duty — they instead watch Article 5 (prohibited manipulative practices) and Article 50 (transparency for chatbots and synthetic content). Do not bolt a monitoring plan onto a system that is not high-risk in the first place.
Who has to do it — provider, not deployer
The Article 72 obligation falls on the provider — the actor that develops a high-risk system, or places it on the market or into service under its own name or trademark (Article 16). The provider designs and runs the monitoring system.
Deployers are a data source, not the operator. Under Article 26 they must use the system per its instructions, keep logs, and notify the provider of serious incidents. Those logs and notifications feed the provider's monitoring, but the deployer does not build or run it.
The line can move. A party that substantially modifies a high-risk system, or rebrands it under its own name, can become a provider under Article 25 — and inherits the Article 72 duty along with the title. Two quick anchors for where this bites: an Annex III point 4(a) recruitment-screening tool, or an Annex III point 2 AI safety component in the operation of critical infrastructure.
How it feeds Article 73 serious-incident reporting
This is the relationship that matters most. Post-market monitoring (Article 72) is the continuous detection mechanism. Serious-incident reporting (Article 73) is the reactive duty that activates when monitoring — or any other source — surfaces a serious incident. In short: Article 72 detects; Article 73 reports.
| Article 72 — post-market monitoring | Article 73 — serious-incident reporting | |
|---|---|---|
| Trigger | Continuous; runs across the lifecycle | Event-triggered by a serious incident |
| Who acts | Provider (runs the system) | Provider (files the report) |
| Cadence | Ongoing collection and analysis | One report, within a fixed deadline |
| Reports to | Internal; feeds risk management | National market surveillance authority |
| Goal | Detect degraded or new risk early | Notify authorities so harm is contained |
The Article 73 deadlines are strict. The provider must report without undue delay and no later than 15 days by default; no later than 10 days where the incident results in a person's death; and no later than 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure.
Monitoring also closes a loop auditors trace. Findings feed back into the Article 9 risk management system — the risk assessment is updated and, where needed, so is the Annex IV technical documentation. And without an active Article 72 system, a provider struggles to establish when it "became aware" of an incident — which is the moment the Article 73 clock starts.
Deadlines and penalties
The Article 72 duty applies once the high-risk obligations apply. High-risk obligations apply from 2 December 2027 for stand-alone systems classified under Article 6(2) and Annex III, and 2 August 2028 for product-embedded high-risk via Article 6(1) and Annex I.
The Digital Omnibus, adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026 — defers these to 2 December 2027 and 2 August 2028 respectively. Both dates are settled; only publication in the Official Journal (expected before 2 August 2026) remains outstanding, as a formality. Plan against the adopted 2 December 2027 date for stand-alone high-risk Annex III. The deferral is fixed calendar dates; the standards-contingent "stop the clock" variant was rejected — and not everything is delayed. The Article 5 prohibitions and Article 4 AI-literacy duty have applied since 2 February 2025, and GPAI obligations under Articles 51–55 since 2 August 2025.
Failing to establish or document the monitoring system breaches a high-risk provider obligation under Article 99(4): fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, Article 99(6) caps the fine at the lower of those two figures. Separately, supplying incorrect, incomplete, or misleading monitoring information to authorities falls under Article 99(5) — up to €7.5 million or 1% of total worldwide annual turnover.
How Confir helps
Confir maps the Article 72 monitoring plan into the Annex IV technical documentation and links each high-risk system to its Article 73 reporting deadlines — 2 days, 10 days, or 15 days — so the correct window surfaces against the system's risk profile rather than being recalled under pressure. The synthesis engine is deterministic and rule-based — no model inference, no hallucination — so the obligations it flags trace directly to the Article you are reading.
Related terms
- Article 72 post-market monitoring: full guide
- how to build a post-market monitoring plan
- Article 73 serious-incident reporting
- serious incident (definition)
- AI incident report template
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →