Post-Market Monitoring Obligations For AI Providers

Drew & AI Comply HQ™ Team · June 25, 2026

Tests before launch can't catch every problem. Once real people use a high-risk AI system, new problems can show up. So the EU AI Act says the company that built it must keep watching it (Article 72). The Act calls this post-market monitoring.

When something goes badly wrong, the company must also tell the authorities by set deadlines (Article 73). These requirements only cover high-risk AI. The high-risk rules start on December 2, 2027 for listed uses (Annex III). AI built into products like medical devices (Annex I, Section A) follows on August 2, 2028.

Why does the Act ask for this?

Real use brings new people, new data, and new situations. A system can drift, or fail in ways nobody saw in testing. Monitoring helps you spot problems early and fix them before they hurt anyone.

It is also how you show the system still meets the rules over its whole life (Article 72(2)).

Who must do it?

The company that builds the system and offers it under its own name. The Act calls that company the provider.

The businesses that use the system (called deployers) help. They watch it as the instructions for use say, and pass on what they see (Article 26(5)).

Which AI systems need it?

Only high-risk AI systems. There are two ways in (Article 6). One is a listed use in Annex III, like hiring or credit scoring. The other is AI inside a regulated product in Annex I, like a medical device. Our guide Is your AI system high-risk? walks through the test.

Chatbots and other AI that is not high-risk have no Article 72 duty. General-purpose AI models with systemic risk (Article 51) have their own incident duty. Their providers report to the EU AI Office and, where needed, to national authorities (Article 55(1)(c)).

What goes into a monitoring system?

The system must fit the technology and its risks (Article 72(1)). Under Article 72(2), it must:

actively and systematically collect data on how the AI performs, for its whole life
record that data and analyze it
use data from the businesses using the AI, and from other sources
check that the AI still meets the high-risk rules in Articles 8 to 15
where relevant, look at how the AI interacts with other AI systems

Sensitive data from police work is left out.

Two good sources are the system's own logs (Article 12(2)(b)) and reports from the businesses using it (Article 26(5)).

Do you need a written plan?

Yes. The monitoring system rests on a written plan (called a post-market monitoring plan). The plan is part of your technical documentation (Article 72(3) and Annex IV, point 9). The Commission will publish a guide and a template for it by September 2, 2027.

Your monitoring system is also part of your written processes for building and running the AI (Article 17(1)(h)). The Act calls those processes a quality management system. Your incident reporting steps belong there too (Article 17(1)(i)).

Some products already have a monitoring plan under other EU product law, like the medical device rules. You can fold the AI Act items into that plan if it protects people just as well (Article 72(4)). Banks and other financial firms can do the same for their Annex III, point 5 systems, like credit scoring.

What counts as a serious incident?

An incident or malfunction is serious when it directly or indirectly leads to any of these (Article 3(49)):

a death, or serious harm to someone's health
a serious and irreversible disruption of critical infrastructure
a breach of EU law that protects fundamental rights
serious harm to property or the environment

The harm has to happen. A near miss that could have caused harm is not a serious incident. It still needs action. If the system presents a risk, investigate and tell the authorities (Article 20(2)).

How fast must you report?

Report a serious incident to the national authority in each EU country where it happened (Article 73(1)). The Act calls it the market surveillance authority. If the EU AI Office supervises your system, report to the AI Office instead (Article 75(1a)). The AI Office supervises two kinds of system (Article 75(1)). The first is a system built on a general-purpose AI model from the same provider or group. That excludes AI in products covered by Annex I, critical infrastructure systems (Annex III, point 2), justice systems (Annex III, point 8), and some systems of law enforcement and border authorities and financial institutions (Article 75(1)(a)(iii)). The second is AI that is, or is part of, a very large online platform or search engine. The deadlines below stay the same.

What happened	Report no later than	Where in the Act
A person died	10 days after you learn of it	Article 73(4)
A serious and irreversible disruption of critical infrastructure, or a widespread breach across several EU countries	2 days after you learn of it	Article 73(3)
Any other serious incident	15 days after you learn of it	Article 73(2)

These are outer limits. Report as soon as you link the incident to your AI, or find a link reasonably likely. You can send an incomplete first report and complete it later (Article 73(5)).

After you report, look into the cause without delay. Assess the risk and fix what you find. Do not change the system in a way that could hide the cause before you tell the authorities (Article 73(6)).

Some providers already report incidents under another EU law with the same kind of rules. For their Annex III systems, they only report breaches of fundamental rights (Article 73(9)). The same limit applies to AI medical devices, which report to the authority their country picks for this (Article 73(10)).

What do the businesses using the system do?

A deployer that spots a serious incident tells the provider first. Then it tells the importer or distributor, and the authority. If it cannot reach the provider, it reports under Article 73 itself (Article 26(5)).

If a deployer thinks the system presents a risk, it tells the provider or distributor and the authority. Then it stops using the system (Article 26(5)).

What if monitoring finds a problem?

If the system no longer meets the rules, fix it right away (Article 20(1)). That can mean bringing it back into line, withdrawing it, disabling it, or recalling it. Tell your distributors and, where relevant, the deployers, importers, and your EU representative.

If the problem puts health, safety, or rights at risk, find the cause with the deployer who reported it. Then tell the authorities (Article 20(2)). Tell the independent testing company that certified the system too, if there is one (called a notified body).

What you learn also feeds your risk management system (Article 9(2)(c)). Our guide to building an EU AI Act risk management system covers that loop.

How long do you keep the records?

Keep your technical documentation for 10 years after the system goes on the market. That file holds your monitoring plan. Keep your quality management system papers for the same 10 years (Article 18(1)). Keep the system's own logs for at least 6 months, if you control them (Article 19(1)).

When does this apply?

These duties only cover high-risk AI systems. The high-risk rules start on:

December 2, 2027 for Annex III systems
August 2, 2028 for Annex I, Section A systems. Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)).

Both dates come from the Digital Omnibus on AI (Regulation (EU) 2026/1744). It moved them in July 2026 (Article 113).

Systems already on the market before your date follow a different rule. They only have to comply if their design changes significantly after that date. AI used by public authorities must comply by August 2, 2030 either way (Article 111(2)).

Frequently asked questions

How is this different from the conformity assessment?

The conformity assessment is the check before launch (Article 43). Monitoring starts at launch and runs for the system's whole life (Article 72). If monitoring leads you to change the system in a big way, you need a new assessment (Article 43(4)). Our conformity assessment guide covers the check.

Do we need special software?

No. The Act does not name a tool. It asks for a documented system that fits your AI's technology and risks (Article 72(1)).

Is there an exemption for small companies?

No. Small and medium-sized companies (SMEs) can simplify parts of their quality paperwork (Article 63(1)). You still have to monitor and report in full (Article 63(2)). Your monitoring system can match your company's size, as long as it protects people just as well (Article 17(2)).

Does this apply to providers outside the EU?

Yes, if the system is offered in the EU, or its output is used in the EU (Article 2(1)). Providers outside the EU also need someone in the EU who acts for them (called an authorised representative, Article 22).

What happens if we get it wrong?

Every provider must set up monitoring and incident reports as part of its quality management system (Articles 16(c) and 17(1)). Breaking a provider duty can cost up to 15 million EUR or 3% of worldwide annual turnover (Article 99(4)). The higher of the two is the cap.

For SMEs, the cap is whichever is lower (Article 99(6)). Since July 2026, the same applies to companies just above SME size. The Act calls them small mid-caps, or SMCs (Article 99(6a)).

Wrong or misleading answers to an authority's request have their own cap. That cap is 7.5 million EUR or 1% of worldwide annual turnover, whichever is higher (Article 99(5)). Our guide to EU AI Act fines and penalties has the full picture.

Update: the Digital Omnibus is now law (October 7, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed for post-market monitoring:

High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
The plan template changed (Article 72(3)). Instead of a binding rule, the Commission now publishes guidance with a template, by September 2, 2027.
Some incident reports now go to the EU AI Office (Article 75(1a)). If the AI Office supervises your system, report serious incidents to it, not to the national authority. The deadlines stay the same.
Small mid-caps get SME help (Article 99). They get the lower fine cap, except for the banned practices.

What did not change: the serious incident definition and the reporting deadlines in Article 73 are the same as before.

To see which dates apply to you, run the free risk check.

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.