AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan)

Providers of a high-risk AI system must establish and document a post-market monitoring system in a manner proportionate to the nature of the AI technologies and the risks of the system.

The post-market monitoring system must actively and systematically collect, document and analyze relevant data on the performance of high-risk AI systems throughout their lifetime, provided by deployers or collected through other sources, which allow the provider to evaluate the continuous compliance of the systems with the requirements set out in Chapter III, Section 2.

Where relevant, post-market monitoring must include an analysis of the interaction with other AI systems, and the obligation does not cover sensitive operational data of deployers that are law-enforcement authorities.

The Regulation defines a post-market monitoring system as all activities carried out by providers of AI systems to collect and review experience gained from the use of the AI systems they place on the market or put into service, to identify any need to immediately apply any necessary corrective or preventive actions.

As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), Article 72(3) bases the post-market monitoring system on a post-market monitoring plan that forms part of the technical documentation referred to in Annex IV, and requires the Commission, taking utmost account of the opinion of the Board, to adopt guidance, including a template, on that plan by 2 September 2027.

The 2024 text of Article 72(3) instead required the Commission to adopt an implementing act establishing a template for the post-market monitoring plan and the list of elements to be included in the plan by 2 February 2026. Recital 41 of Regulation (EU) 2026/1744 describes the change to Article 72(3) as the removal of the empowerment to adopt a harmonised template for a post-market monitoring plan, and calls the template the Commission's guidance is to include a voluntary template.

For a high-risk AI system covered by the Union harmonisation legislation listed in Section A of Annex I, where a post-market monitoring system and plan are already established under that legislation, the provider may integrate the necessary elements of Article 72(1) to (3), using the template referred to in Article 72(3), into the existing system and plan, provided that achieves an equivalent level of protection, and the same choice applies to a high-risk AI system referred to in point 5 of Annex III placed on the market or put into service by a financial institution subject to internal-governance requirements under Union financial services law.

Article 72 sits in Chapter IX, which keeps the Regulation's general application date of 2 August 2026, but its duty falls on providers of high-risk AI systems, and the Digital Omnibus moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to 2 December 2027 for a system classified under Article 6(2) and Annex III and to 2 August 2028 for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, so no provider of a system placed on the market or put into service is bound by Article 72 before 2 December 2027; the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Article 72 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.