Post-market monitoring obligations for AI providers — 2026-06-25

TL;DR — Under the EU AI Act, high-risk AI system providers must establish and maintain post-market monitoring systems to detect and report serious incidents, malfunctions, and safety risks. Obligations include collecting performance data, documenting adverse events, maintaining records for ten years, and notifying competent authorities and users of significant issues. These requirements apply from the Act's enforcement date and are critical for compliance and consumer protection.

What are post-market monitoring obligations under the EU AI Act?

Post-market monitoring is a mandatory system that AI providers deploying high-risk systems must establish to continuously observe how their AI systems perform in real-world conditions. This includes detecting serious incidents, malfunctions, and safety risks that may not have been identified during pre-deployment testing. Providers must collect and analyse relevant data, maintain comprehensive records, and report findings to competent authorities when necessary.

Which AI systems trigger post-market monitoring requirements?

Post-market monitoring obligations apply primarily to high-risk AI systems as classified under the EU AI Act. These include systems used in critical infrastructure, law enforcement, employment, education, and access to essential services. The specific list of high-risk categories is defined in Annex III of the Regulation, and providers of systems in these categories must establish monitoring procedures before placing systems on the market.

What must be documented and reported?

Providers must document and maintain records of serious incidents and malfunctions, including those that cause or could cause death, serious injury, or significant property damage. Under the EU AI Act, records must be kept for a minimum of ten years. Serious incidents must be reported to competent authorities without undue delay. Additionally, providers should notify users and relevant stakeholders when significant safety issues are identified, and implement corrective measures such as system updates or recalls where appropriate.

How long must records be retained?

The EU AI Act requires providers to maintain post-market monitoring records for at least ten years from the time a high-risk AI system is placed on the market. This extended retention period ensures that long-term performance patterns, emerging risks, and historical data are available for audits, investigations, and regulatory oversight. Providers should ensure secure, organised storage systems capable of supporting this obligation.

What happens if monitoring obligations are not met?

Non-compliance with post-market monitoring obligations constitutes a violation of the EU AI Act and may result in administrative fines, enforcement action by national competent authorities, and reputational damage. Fines for high-risk system violations can reach significant levels. Beyond penalties, failure to monitor increases the risk that serious harms go undetected, exposing providers to civil liability and user complaints.

Frequently asked questions

Q: Do all AI systems require post-market monitoring?

A: No. Post-market monitoring obligations apply specifically to high-risk AI systems under the EU AI Act. Lower-risk systems and general-purpose AI models have different or less stringent requirements.

Q: What is a "serious incident" in the context of post-market monitoring?

A: Under the EU AI Act, a serious incident is one that results in or could reasonably result in death, serious injury, substantial property damage, or significant harm to health, safety, or fundamental rights. The definition is intentionally broad to capture significant risks.

Q: Who is responsible for post-market monitoring—the provider or the deployer?

A: Responsibility primarily lies with the AI provider, though deployers (users) have complementary obligations to report serious incidents to providers and authorities. Distributors may also share certain responsibilities depending on their role.

Q: How should monitoring data be collected and analysed?

A: Providers should establish systematic processes to collect relevant performance and safety data from deployed systems, analyse it for patterns or anomalies, and assess whether incidents constitute serious harms or safety risks. Methods may include user feedback mechanisms, automated logging systems, periodic audits, and stakeholder engagement.

Q: What is the difference between post-market monitoring and conformity assessment?

A: Conformity assessment occurs before a system enters the market and verifies compliance with regulatory requirements. Post-market monitoring occurs after deployment and is an ongoing obligation to detect emerging risks and adverse effects in real-world use.

Q: Are there different requirements for EU and non-EU providers?

A: The EU AI Act applies to providers placing high-risk systems on the EU market, regardless of where they are established. Non-EU providers must comply if their systems reach EU users.

Sources

This article is informational and does not constitute legal advice. Consult qualified counsel for your specific situation.