What does post-market monitoring require under Article 72 of the EU AI Act?

A provider of a high-risk AI system establishes and documents a post-market monitoring system that actively and systematically collects, documents and analyses data on the system's performance throughout its lifetime, to evaluate its continuous compliance with the requirements in Chapter III, Section 2 (Article 72). The system rests on a plan that is part of the Annex IV technical documentation (Article 72(3), as replaced by Regulation (EU) 2026/1744).

Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article 72(3) was replaced; paragraphs 1, 2 and 4 were not amended.

Who does Article 72 bind?

Providers. Article 72(1) has them establish and document the system "in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system", and Article 17(1), point (h) puts its setting-up, implementation and maintenance in the quality management system. Article 3, point (25) defines it as all activities providers carry out to collect and review experience gained from the use of the AI systems they place on the market or put into service, to identify any need to immediately apply any necessary corrective or preventive actions.

Deployers feed it: the first sentence of Article 26(5) has them monitor the operation of the system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72.

What must the post-market monitoring system do?

Under Article 72(2), the system actively and systematically collects, documents and analyses relevant data on the performance of high-risk AI systems throughout their lifetime, which may be provided by deployers or collected through other sources, and which allow the provider to evaluate continuous compliance with the requirements in Chapter III, Section 2. Where relevant, it includes an analysis of the interaction with other AI systems. The obligation does not cover sensitive operational data of deployers which are law-enforcement authorities.

Its data feeds the evaluation of other risks in Article 9(2), point (c), a step of the risk management system, and Article 12(2), point (b) has the logging capabilities enable the recording of events relevant for facilitating it.

What goes into the post-market monitoring plan?

Article 72(3), as replaced, keeps its first two sentences: the system "shall be based on a post-market monitoring plan", and the plan "shall be part of the technical documentation referred to in Annex IV". Point 9 of Annex IV asks for a detailed description of the system in place to evaluate performance in the post-market phase in accordance with Article 72, including the plan.

The rest changed. The 2024 text had the Commission adopt an implementing act by 2 February 2026, under the examination procedure in Article 98(2), establishing a template and the list of elements to be included in the plan. Article 72(3) now reads: "The Commission, taking utmost account of the opinion of the Board, shall adopt guidance, including a template, on the post-market monitoring plan by 2 September 2027." Recital 41 of Regulation (EU) 2026/1744 calls the template voluntary. With no list of elements in either text, write the plan against paragraphs 1 and 2.

Can you fold it into monitoring you already run?

Two routes, both in Article 72(4). The first subparagraph covers high-risk AI systems under the Union harmonisation legislation listed in Section A of Annex I, where a post-market monitoring system and plan are already established under that legislation: providers have a choice of integrating, as appropriate, the necessary elements of paragraphs 1, 2 and 3 "using the template referred in paragraph 3" into those systems and plans, provided that it achieves an equivalent level of protection.

The second subparagraph applies the same rule to point 5 of Annex III systems placed on the market or put into service by financial institutions subject to requirements under Union financial services law regarding their internal governance, arrangements or processes. Fintech classification decides whether yours qualify.

Neither route removes the elements, and Article 17(4) does not either: it deems a financial institution's quality management system obligation fulfilled through its financial services rules except for Article 17(1), points (g), (h) and (i), and point (h) is the post-market monitoring system. Article 72(4), unamended, still integrates using the template of Article 72(3), now part of guidance due by 2 September 2027, and does not say how the route works without it.

When does Article 72 apply?

Article 72 is in Chapter IX. The exceptions in Article 113, third paragraph, reach only one provision of that chapter, Article 78, so Article 72 takes the general date in the second paragraph: 2 August 2026.

Open question: Article 72 governs high-risk AI systems, and the classification rules in Chapter III, Section 1, Article 6(5) excepted, apply from 2 December 2027 for systems classified as high-risk pursuant to Article 6(2) and Annex III, and from 2 August 2028 for those classified pursuant to Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced). Regulation (EU) 2026/1744 does not say how a Chapter IX duty operates while those rules are not yet in application. Systems placed on the market or put into service earlier are a question of their own under Article 111(2), as replaced.

What does Complipath do here, and what does it not?

Post-market monitoring (Article 72): We found no support for this in what we have built. Serious incident reporting (Article 73): the same. The AI inventory records each system with its classification and the article behind it, and each duty that follows carries an owner, a status and a date. Annex IV documentation is drafted from the register and says which limbs it could not answer; the plan is yours to write. A change to a provision your records cite is emailed per affected system. The full table is what Complipath is.

What this means for you

If you're a provider: mark the high-risk systems first: Article 72 binds those alone. For each, write the plan into the Annex IV file against paragraphs 1 and 2: which data from which deployers and other sources, how it is analysed and how the result reaches the Article 9(2), point (c) evaluation. If Article 72(4) covers you, decide whether to integrate and record why the protection is equivalent.

If you're a deployer: Article 72 binds you only if you are also the provider. Ask each provider what its plan expects from you under Article 26(5).

FAQ

Does Article 72 apply to deployers? No. Article 72 binds providers of high-risk AI systems. Deployers come in through Article 26(5), which has them monitor the system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Article 72(2) names deployers as one source of the data the provider collects.

Is there an official template for the post-market monitoring plan? Not in the Regulation itself. Article 72(3), as replaced by Regulation (EU) 2026/1744, has the Commission adopt guidance, including a template, on the plan by 2 September 2027, taking utmost account of the opinion of the Board. That replaced an implementing act due by 2 February 2026, and recital 41 of the amending act calls the template voluntary.

Can a bank use the monitoring it already runs? For point 5 of Annex III systems it places on the market or puts into service, it may fold the Article 72 elements in. Article 72(4), second subparagraph, extends the integration route to financial institutions subject to requirements under Union financial services law regarding their internal governance, arrangements or processes, provided an equivalent level of protection is achieved.

When do we need post-market monitoring in place? Article 72 takes the general date of 2 August 2026 (Article 113, second paragraph); no exception reaches it. It attaches to high-risk systems, whose classification rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as replaced). How the two fit is open.

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 3, point (25), Article 6, Article 9(2), Article 12(2), Article 17, Article 26(5), Article 72, Article 73, Article 78, Article 98(2), Article 111(2), Article 113 and Annexes I, III and IV; as amended by Regulation (EU) 2026/1744 (EUR-Lex) and its recital 41, which replaced Article 17(2), Article 72(3), Article 111(2) and Article 113, third paragraph, point (c), inserted paragraphs 1a, 1b and 1c in Article 6, and deleted point 1 of Section A of Annex I. Paragraphs 1, 2 and 4 of Article 72 were not amended.

Where this question meets the product: what counts as evidence for each requirement. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire.