Risk · R-097 · Governance & Accountability
Post-market monitoring gap
No plan exists to collect and act on evidence of how a system performs and what effects it has after release.
- Severity
- Medium
- Audience
- Heads-of · Practitioner
- Frameworks
- Principle 12 · Article 72 · MANAGE 4
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
Post-market monitoring is the organised collection of evidence about a system in real use: performance, complaints, incidents, misuse and effects on people, reviewed on a schedule with authority to act. It differs from technical monitoring in scope, since it includes what users and affected people report, and in purpose, since it asks whether the system should continue as it is. The risk is that release is treated as the end of assurance.
How it happens
- The project team disbands at launch.
- Technical measures are watched and complaints are handled elsewhere.
- No one is tasked with reviewing the evidence together.
- A supplier is assumed to be monitoring on the organisation's behalf.
Why it matters
Many harms appear only at scale and over time. Without a plan to look, the organisation learns of them from the press, a regulator or a claim. Providers of high-risk systems under the EU AI Act must operate a documented post-market monitoring system.
Warning signs
- No document describes what is reviewed after launch, by whom and how often.
- Complaints mentioning the system are not tagged or collated.
- No system has been modified or withdrawn as a result of evidence from use.
- Reviews stopped when the project closed.
Mitigating controls
Primary controls
- Post-market monitoring plan Detective
- Establishes the plan for collecting and acting on evidence after release. A documented plan sets out how evidence of a system's performance, use and effects is collected, reviewed and acted on throughout its life.
Supporting controls
- Drift and performance monitoring Detective
- Supplies the performance evidence. Input distributions and output quality are measured in production against thresholds that trigger investigation, retraining or withdrawal.
- Feedback and complaints channel for AI Detective
- Supplies evidence from users and affected people. Users and affected people can report a problem with an AI system easily, and reports are triaged, linked to the system concerned and analysed for patterns.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Code of Practice for the Cyber Security of AI | Principle 12 | Monitor your system's behaviour Monitoring of system behaviour. |
| EU AI Act | Article 72 | Post-market monitoring The duty this risk is a failure of. |
| NIST AI Risk Management Framework (AI RMF 1.0) | MANAGE 4 | Risk response, recovery and communication plans are documented and monitored Monitoring of deployed systems. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
- NIST AI Risk Management Framework (AI RMF 1.0) NIST · framework
Related terms
How to cite
Axiom Verity (2026). Post-market monitoring gap. Reference Library, R-097. https://axiom-verity.com/risks/post-market-monitoring-gap. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.