Risk · R-136 · Operational Resilience
AI monitoring and alerting gap
A system's behaviour in production is not measured against thresholds that trigger action, so degradation, misuse and harm are noticed late or by accident.
- Severity
- High
- Audience
- Heads-of · Practitioner
- Frameworks
- Principle 12 · Article 26 · Article 72 · MEASURE 3
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it is
Conventional monitoring asks whether a system is up and how fast it responds. An AI system can be fully available and wrong. Monitoring it means watching what it does: the quality of outputs, the mix of inputs, refusal and override rates, safety filter activity, cost, and what users report. It also means thresholds, owners and a response when a threshold is crossed. The risk is that some of this is missing, or that data is collected and nobody is tasked with acting on it. Specific forms are covered in AI model drift and degradation and post-market monitoring gap.
How it happens
- Monitoring was inherited from the application platform and covers uptime only.
- Dashboards exist with no alert thresholds.
- Alerts go to a team that does not own the model.
- Quality cannot be measured automatically, and no sampling was set up in its place.
Why it matters
Monitoring is the detective control on which the corrective ones depend. If a fault is not seen, it is not escalated, not stopped and not remediated, and the period of harm is set by chance.
Warning signs
- Production reports for an AI system show availability and latency only.
- The last several incidents were found by customers or staff.
- Alerts have no named owner or are routinely ignored.
- Nobody reviews samples of live output.
Who owns it
The system owner is accountable for knowing how the system is behaving. Engineering builds the monitoring. Operations respond to alerts. Governance receives the summary.
In practice
A summarisation tool used by case handlers starts omitting the final section of long documents after a change in how files are split. Uptime is perfect. It is noticed five weeks later by a handler who happens to read an original. The same pattern generalises to any system watched for whether it runs and not for what it produces.
Mitigating controls
Primary controls
- AI system monitoring and logging Detective
- Collects the operational signals. Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act.
- Drift and performance monitoring Detective
- Measures quality and inputs against thresholds that trigger action. Input distributions and output quality are measured in production against thresholds that trigger investigation, retraining or withdrawal.
Supporting controls
- AI risk reporting to the board Detective
- Aggregates indicators for oversight. Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge.
- Feedback and complaints channel for AI Detective
- Adds what users and affected people report. Users and affected people can report a problem with an AI system easily, and reports are triaged, linked to the system concerned and analysed for patterns.
- Post-market monitoring plan Detective
- Sets out what will be monitored after release and who acts on it. A documented plan sets out how evidence of a system's performance, use and effects is collected, reviewed and acted on throughout its life.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Code of Practice for the Cyber Security of AI | Principle 12 | Monitor your system's behaviour Monitoring of system behaviour. |
| EU AI Act | Article 26 | Obligations of deployers of high-risk AI systems Deployers must monitor operation. |
| EU AI Act | Article 72 | Post-market monitoring Post-market monitoring. |
| NIST AI Risk Management Framework (AI RMF 1.0) | MEASURE 3 | Mechanisms track identified risks over time Tracking of risks. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
- NIST AI Risk Management Framework (AI RMF 1.0) NIST · framework
Related terms
How to cite
Axiom Verity (2026). AI monitoring and alerting gap. Reference Library, R-136. https://axiom-verity.com/risks/ai-monitoring-and-alerting-gap. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.