EU AI Act Post-Market Monitoring & Incident Reporting (Articles 72–73)

Article 72: Post-Market Monitoring

Providers of high-risk AI systems must actively monitor how their systems perform after they are placed on the market or put into service:

• Establish and document a post-market monitoring system proportionate to the nature of the AI technology and its risks
• Collect, document and analyse relevant data on performance throughout the system's lifetime, including from deployers and other sources
• Base the activity on a post-market monitoring plan that forms part of the technical documentation — the Commission is to provide a template
• Use the monitoring to evaluate continued compliance and detect problems that need corrective action

Article 73: Serious-Incident Reporting

When something goes seriously wrong, Article 73 imposes short, tiered deadlines to report to the market surveillance authority. A serious incident includes death or serious harm to health, serious and irreversible disruption of critical infrastructure, breach of fundamental-rights obligations, or serious harm to property or the environment:

• General rule: report immediately after the provider establishes a causal link (or reasonable likelihood) between the system and the incident, and no later than 15 days after becoming aware
• Widespread infringement or serious and irreversible disruption of critical infrastructure: no later than 2 days
• Death of a person: no later than 10 days
• An initial, possibly incomplete report may be filed first to meet the deadline, followed by a complete report; the provider must also investigate and take corrective action

The clock is short — days, not months. Reconstructing what an agent did, after the fact, without a durable record is exactly where teams get caught out.

The Feedback Loop into Article 9

Monitoring and incident reporting are not standalone paperwork — they close the loop back into risk management:

• Findings from post-market monitoring feed the Article 9 risk-management system, which must be a continuous, iterative process across the lifecycle
• Serious incidents and identified risks trigger review and update of risk controls and, where needed, the technical documentation
• This makes compliance an ongoing operational discipline, not a one-off pre-market conformity exercise
• Good production evidence is what lets you both report accurately and prove you acted on what you found