Why does continuous monitoring of AI systems matter? Article 72 of the AI Act explained simply
Why does continuous monitoring of AI systems matter? Because an AI system does not stay the same after release. Real-world data changes, use changes and performance can drop. Continuous monitoring is crucial to keep AI up to date and performing well. It also catches errors and harm in time.
For high-risk AI systems it is not just good practice: it is a duty under the AI Act, Regulation (EU) 2024/1689. The provider establishes a post-market monitoring system (Article 72). The deployer monitors the operation of the system (Article 26(5)). Serious incidents are reported within 15, 10 or 2 days (Article 73).
The quiz answer. Many multiple-choice tests ask this question. The right answer is: “it is crucial to keep AI up to date and performing well”. The other options are wrong. Monitoring is not only for very simple systems. It is not only about controlling costs. And a trained system does not run on its own forever.
This page follows the consolidated text in force since 27 July 2026 (CELEX 02024R1689-20260727), as amended by Regulation (EU) 2026/1744.
Article 72: the provider's post-market monitoring
Article 3, point 3, defines the provider. It develops an AI system, or has it developed. It then places it on the market or puts it into service under its own name or trademark.
Article 72(1) requires the provider to establish and document a post-market monitoring system. It must be proportionate to the nature of the technology and to the risks. Under paragraph 2, the system must “actively and systematically collect, document and analyse relevant data” on the performance of high-risk AI systems. It does so “throughout their lifetime”.
The data may come from deployers or from other sources. The provider uses it to check that the system still meets the requirements in Chapter III, Section 2. Where relevant, monitoring also covers the interaction with other AI systems.
Paragraph 3 adds a document: the post-market monitoring plan. The plan is part of the technical documentation in Annex IV, point 9. Our free Annex IV technical documentation template covers that point too.
There is no official template for the plan yet. Paragraph 3 asks the Commission to adopt guidance, “including a template”, by 2 September 2027. The 2024 text required an implementing act by 2 February 2026. Regulation (EU) 2026/1744 changed this.
Paragraph 4 avoids duplicate work. Some Annex I, Section A products already have a monitoring system and plan under their own law. Their provider may integrate the AI Act elements there, with an equivalent level of protection. The same option applies to financial institutions that place Annex III, point 5 systems on the market or put them into service.
Article 26(5): what the deployer monitors
The deployer is whoever uses an AI system under its own authority, for example a company that uses CV-screening software. Article 26(5) asks the deployer to do four things:
- monitor the operation of the system “on the basis of the instructions for use” and, where relevant, inform providers;
- if use in line with the instructions may present a risk (Article 79(1)), inform the provider or distributor without undue delay. Also inform the market surveillance authority and suspend use of the system;
- if it identifies a serious incident, immediately inform first the provider, then the importer or distributor and the market surveillance authorities;
- if it cannot reach the provider, apply Article 73 “mutatis mutandis”: the reporting rules apply to the deployer, with the necessary changes.
Paragraph 6 adds a duty on logs. The deployer keeps the logs the system generates automatically, to the extent they are under its control. It keeps them for at least six months, unless other Union or national law says otherwise.
Deployers that are financial institutions have a special rule (paragraph 5, second subparagraph). Their monitoring duty counts as met when they follow the internal governance rules of financial services law.
Article 73: serious incidents and reporting deadlines
Article 3, point 49, defines a serious incident. It is an incident or malfunctioning of an AI system that directly or indirectly leads to any of the following:
- a) the death of a person, or serious harm to a person's health;
- b) a serious and irreversible disruption of the management or operation of critical infrastructure;
- c) the infringement of obligations under Union law intended to protect fundamental rights;
- d) serious harm to property or the environment.
The provider reports to the market surveillance authorities of the Member State where the incident occurred. Each deadline runs from when the provider or, where applicable, the deployer becomes aware of the incident:
| Case | Latest deadline | Article |
|---|---|---|
| Serious incident, general rule | Immediately after establishing a causal link, or its reasonable likelihood, and at the latest 15 days after becoming aware | Art. 73(2) |
| Widespread infringement, or serious and irreversible disruption of critical infrastructure (Article 3, point 49(b)) | Immediately, and at the latest 2 days after becoming aware | Art. 73(3) |
| Death of a person | Immediately after establishing or suspecting a causal relationship, and at the latest 10 days after becoming aware | Art. 73(4) |
To meet the deadline, the provider or deployer may first submit an incomplete initial report, then a complete one (paragraph 5). The reporting period also takes account of how severe the incident is (paragraph 2).
After reporting, the provider investigates without delay. The investigation includes a risk assessment of the incident and corrective action. Before informing the competent authorities, it must not alter the system in a way that could affect the later evaluation of the causes (paragraph 6).
There is help to prepare. On 26 September 2025 the Commission published, for consultation, draft guidance and a reporting template for serious incidents.
Cheat sheet: who has which monitoring duties
This table sums up Articles 19, 20, 26, 72 and 73 for high-risk AI systems. It is a summary, not an official form.
| Topic | Provider | Deployer |
|---|---|---|
| Monitoring | Establishes and documents a post-market monitoring system and its plan (Art. 72(1) and (3)) | Monitors the operation on the basis of the instructions for use (Art. 26(5)) |
| Data and logs | Collects and analyses performance data over the whole lifetime (Art. 72(2)). Keeps the logs under its control for at least six months (Art. 19(1)) | Keeps the logs under its control for at least six months (Art. 26(6)) |
| Risk during use | Once aware of a risk (Art. 79(1)), investigates the causes, with the reporting deployer where applicable, and informs the market surveillance authorities (Art. 20(2)) | Informs the provider or distributor and the market surveillance authority without undue delay, and suspends use (Art. 26(5)) |
| Serious incident | Reports it to the market surveillance authority within 15, 10 or 2 days, then investigates (Art. 73) | Immediately informs the provider first, then the importer or distributor and the market surveillance authorities (Art. 26(5)) |
When do Articles 72, 73 and 26 apply?
The Regulation applies from 2 August 2026 (Article 113). Articles 72 and 73 sit in Chapter IX, which Article 113 does not postpone.
Regulation (EU) 2026/1744 postponed Chapter III, Sections 1, 2 and 3. These sections apply from 2 December 2027 to Annex III systems and from 2 August 2028 to Annex I systems. They hold the classification rules of Article 6 and the duties in Articles 19, 20 and 26.
Watch out for systems already on the market. Some high-risk systems were placed on the market or put into service before Chapter III applied to them. The Regulation applies to them only if their design changes significantly from that date. In any case, providers and deployers of systems intended for public authorities must comply by 2 August 2030 (Article 111(2)).
How to set up continuous monitoring: five practical steps
These steps are good practice, not a list set by law. The legal duties are the ones in the sections above.
- List the AI systems you use or develop. Check which ones fall under Annex III (Annex 3).
- For each system, write down your role: provider, deployer or both.
- As a provider, write the post-market monitoring plan and put it in the technical documentation. Say which data you collect, from which sources and who analyses it.
- As a deployer, read the instructions for use. Decide who checks the system, what they look at and how often.
- Prepare the serious incident procedure now: who decides, who reports and within how many days. Keep evidence of every check and every report.
How LandingRed helps
LandingRed keeps a post-market monitoring plan for each AI system. Critical threshold alerts open an incident automatically, and the Article 73 deadline is calculated for you. LandingRed does not file the report with the authority. It records the reference the authority gives you.
Read more on the LandingRed page on the AI Act, or start with the free self-assessment: in about five minutes it estimates your exposure and obligations under the AI Act.
Frequently asked questions on continuous monitoring of AI systems
Why does continuous monitoring of AI systems matter?
Because the performance of an AI system can change after release. Continuous monitoring keeps AI up to date and performing well, and catches errors and harm in time. For high-risk systems it is a legal duty: Article 72 for the provider, Article 26(5) for the deployer.
Who must carry out post-market monitoring?
The provider of the high-risk AI system (Article 72). The deployer does not run the provider's monitoring system. It monitors the operation of the system on the basis of the instructions for use and, where relevant, informs the provider (Article 26(5)).
Is there an official template for the monitoring plan?
Not yet. Article 72(3) asks the Commission for guidance, including a template, by 2 September 2027. Either way, the plan is part of the technical documentation in Annex IV, point 9.
Within how many days must a serious incident be reported?
Immediately after a causal link, or its reasonable likelihood, is established. At the latest, 15 days after the provider or deployer becomes aware of it. The limit is 10 days if a person died. It is 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure (Article 73).
When do the monitoring duties apply?
Articles 72 and 73 sit in Chapter IX, which Article 113 does not postpone: they apply from 2 August 2026. Article 26, on deployer duties, sits in Chapter III, Section 3. It applies from 2 December 2027 to Annex III systems and from 2 August 2028 to Annex I systems.
Related resources
- How to monitor AI systems under the EU AI Act: the ten dimensions
- Annex III (Annex 3): the 8 high-risk areas
- Annex IV technical documentation template
- LandingRed for the EU AI Act
This is information, not legal advice. Only the texts published in the Official Journal of the European Union are legally binding.
Is your system high-risk? Check the classification before you set up monitoring. Take the free self-assessment.
Reviewed and published under the editorial responsibility of AB Corporate Advisory S.R.L.
LandingRed automates all of this
Stop managing compliance in spreadsheets. Classify, document, assess, and monitor your AI systems from one platform.