# Post-deployment monitoring and drift detection

- **Record type**: Control
- **Kind**: Technical measure
- **Owner**: AI system owner
- **Frequency**: Continuous
- **Duties served**: 10

## What the control achieves

Watches a live AI system for falling performance, shifting data, emerging bias and unexpected use, and turns what it sees into corrective action, incident reports and documentation updates.

## How it is typically implemented

Each deployed system has a monitoring plan that names the indicators to be tracked, the thresholds that trigger review, the feedback channels open to users and deployers, and who looks at the results and how often. Telemetry from logs, sampled human review of outputs, complaint data and periodic re-testing feed a dashboard or report. When an indicator breaches its threshold the owner opens a ticket, decides whether retraining, rollback, extra oversight or an incident report is needed and records the outcome. Monitoring findings are reviewed at governance meetings and feed the annual refresh of the risk and impact assessments.

## Evidence it produces

- Post-market monitoring plan (procedure): Indicators, thresholds, feedback channels, review cadence and responsibilities for one system.
- Monitoring dashboard or periodic monitoring report (monitoring_record)
- Monitoring review decision (approval_record): Recorded decision on retraining, rollback or escalation after a threshold breach.

## Legal duties this control serves

- Establish a risk management system for high-risk AI — EU AI Act, European Union (supports): https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system
- Achieve appropriate accuracy, robustness and cybersecurity — EU AI Act, European Union (supports): https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity
- Use high-risk AI as instructed, monitor it and inform affected people — EU AI Act, European Union (supports): https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations
- Operate a post-market monitoring system — EU AI Act, European Union (satisfies): https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring
- Deployers must ensure input data they control is relevant and representative — EU AI Act, European Union (supports): https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data
- Deployers must monitor high-risk AI, suspend use on risk and report serious incidents — EU AI Act, European Union (satisfies): https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension
- Manage data quality, model development and monitoring across the lifecycle — Singapore Model AI Governance Framework, Singapore (satisfies): https://aipolicytracker.org/obligations/singapore-mgf-operations-management
- Deployers must complete impact assessments for high-risk AI — Colorado AI Act, Colorado (United States) (supports): https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment
- Developers must notify the Attorney General and deployers of discovered algorithmic discrimination — Colorado AI Act, Colorado (United States) (supports): https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general
- Measure and test trustworthiness characteristics (Measure) — NIST AI RMF, United States (supports): https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure

## Standards clauses it corresponds to (clause numbers only)

- ISO/IEC 42001:2023: Clause 9.1; Annex A.6.2.6
- NIST AI RMF 1.0: MEASURE 3.1, 3.3; MANAGE 4.1
- ISO/IEC 23894:2023: Clause 6.6 — Monitoring and review of AI risks.

## MIT AI Risk Repository subdomains addressed

7.3, 1.3, 5.1, 6.5

## Provenance

- **Record page**: https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection
- **Official source**: none recorded — this record is incomplete, see https://aipolicytracker.org/gaps
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.