EU AI Act Art.72: Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
Article 72 of the EU AI Act binds the provider. It requires Providers must establish and document a post-market monitoring system proportionate to the nature of the AI technologies and to the. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.72 |
| Binds | Provider |
| Group | Post-Market Monitoring, Market Surveillance and Rights |
| Evidence items | 6 |
| Linked NIST AI RMF controls | 7 |
| Linked ISO/IEC 42001 controls | 3 |
| Last updated |
Who does Art.72 bind?
The article binds the provider. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.72 require?
Providers must establish and document a post-market monitoring system proportionate to the nature of the AI technologies and to the risks of the high-risk AI system. That system must actively and systematically collect, document and analyse relevant data on the performance of the system throughout its lifetime, whether provided by deployers or collected through other sources, so the provider can evaluate the system's continuous compliance with the Chapter III Section 2 requirements, including where relevant an analysis of interaction with other AI systems. The system must be based on a post-market monitoring plan that forms part of the Annex IV technical documentation and follows the template adopted by the Commission. Where an equivalent post-market monitoring system and plan already exist under Section A of Annex I legislation, the required elements may be integrated into them provided an equivalent level of protection is achieved.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.72 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.72?
| Category | Evidence to keep |
|---|---|
| Post-market monitoring | The documented post-market monitoring system, with the reasoning behind its proportionality recorded |
| Post-market monitoring | The post-market monitoring plan following the Commission template, held within the Annex IV technical documentation |
| Post-market monitoring | Collected performance data with evidence that it is analysed rather than merely stored |
| Post-market monitoring | A record of the channel through which deployer supplied data reaches the provider |
| Post-market monitoring | Periodic evaluations of continuous compliance with the Section 2 requirements, and the actions they triggered |
| Post-market monitoring | Where relevant, the analysis of interaction with other AI systems |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.72?
7 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-1.5 | Ongoing monitoring and periodic review of the risk management process and its outcomes are planned, organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review Post-market monitoring reviews the system, not the risk management process itself. | medium |
AIRMF-GV-5.1 | Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks Data collected from deployers is external input but is performance data, not impact feedback. | medium |
AIRMF-MN-2.1 | Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods, to reduce the magnitude or likelihood of potential impacts | unrated |
AIRMF-MN-4.1 | Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management A documented post-market monitoring system built on a plan in the technical documentation is this artefact. | high |
AIRMF-MP-5.2 | Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented Monitoring collects deployer data but does not evidence standing engagement personnel. | medium |
AIRMF-MS-1.2 | Appropriateness of AI metrics and effectiveness of existing controls is regularly assessed and updated, including reports of errors and impacts on affected communities Evaluating continuous compliance from field data is regular reassessment of metrics and control effectiveness. | high |
AIRMF-MS-2.4 | The functionality and behavior of the AI system and its components, as identified in the MAP function, are monitored when in production Systematically collecting and analysing performance data throughout the lifetime is production monitoring. | high |
Which ISO/IEC 42001 controls line up with Art.72?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.10.4 | Customers Post market monitoring systematically collects performance data provided by deployers. | medium |
A.6.2.6 | AI system operation and monitoring Documented post market monitoring collects and analyses performance data throughout the lifetime. | high |
A.8.3 | External reporting Monitoring collects data from deployers and other sources, without a public reporting channel. | medium |
What does the conformance kit add for Art.72?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.