{"slug":"post-market-monitoring-and-drift-detection","id":"AIPT-CTL-0018","title":"Post-deployment monitoring and drift detection","kind":"technical","kind_label":"Technical measure","purpose":"Watches a live AI system for falling performance, shifting data, emerging bias and unexpected use, and turns what it sees into corrective action, incident reports and documentation updates.\n","description":"Each deployed system has a monitoring plan that names the indicators to be tracked, the thresholds that trigger review, the feedback channels open to users and deployers, and who looks at the results and how often. Telemetry from logs, sampled human review of outputs, complaint data and periodic re-testing feed a dashboard or report. When an indicator breaches its threshold the owner opens a ticket, decides whether retraining, rollback, extra oversight or an incident report is needed and records the outcome. Monitoring findings are reviewed at governance meetings and feed the annual refresh of the risk and impact assessments.\n","owner_role":"AI system owner","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["7.3","1.3","5.1","6.5"],"evidence":[{"type":"procedure","title":"Post-market monitoring plan","description":"Indicators, thresholds, feedback channels, review cadence and responsibilities for one system."},{"type":"monitoring_record","title":"Monitoring dashboard or periodic monitoring report","description":null},{"type":"approval_record","title":"Monitoring review decision","description":"Recorded decision on retraining, rollback or escalation after a threshold breach."}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 9.1; Annex A.6.2.6","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 3.1, 3.3; MANAGE 4.1","note":null,"confidence_level":"high"},{"framework":"iso_23894","framework_name":"ISO/IEC 23894:2023","reference":"Clause 6.6","note":"Monitoring and review of AI risks.","confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","relationship":"supports","note":"Post-market data feeds risk re-evaluation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","relationship":"supports","note":"Monitoring operation and informing the provider of risks.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"eu-ai-act-art-26-4-deployer-input-data","title":"Deployers must ensure input data they control is relevant and representative","relationship":"supports","note":"Detects input drift away from the intended population.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data"},{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","relationship":"satisfies","note":"Deployer-side monitoring with feedback to the provider.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","relationship":"satisfies","note":"Documented monitoring plan with indicators, feedback channels and review cadence.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","title":"Achieve appropriate accuracy, robustness and cybersecurity","relationship":"supports","note":"Consistent performance over the lifecycle is confirmed in operation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity"},{"slug":"us-colorado-ai-act-developer-disclosure-to-attorney-general","title":"Developers must notify the Attorney General and deployers of discovered algorithmic discrimination","relationship":"supports","note":"Ongoing testing is one of the discovery routes the statute names.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general"},{"slug":"singapore-mgf-operations-management","title":"Manage data quality, model development and monitoring across the lifecycle","relationship":"satisfies","note":"Active monitoring and regular tuning after deployment.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management"},{"slug":"us-colorado-deployer-impact-assessment","title":"Deployers must complete impact assessments for high-risk AI","relationship":"supports","note":"Post-deployment monitoring described in the assessment.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment"},{"slug":"us-nist-ai-rmf-measure","title":"Measure and test trustworthiness characteristics (Measure)","relationship":"supports","note":"Tracking metrics over time.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure"}],"related_controls":["record-keeping-and-logging","ai-incident-management-and-reporting","accuracy-robustness-security-testing","ai-risk-assessment"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection","context_url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection.md"}