Start with your role and the system in scope.
A provider's post-market monitoring programme and a deployer's operational review are related but different activities. Article 72 addresses a documented monitoring system and plan for providers of high-risk AI. Article 26 separately describes deployer monitoring responsibilities.
Agree the information your organisation can actually obtain. Supplier reports, user feedback, operational metrics and incident records may each contribute, but none should be presented as complete coverage without understanding its limitations.
Define signals, review dates and response owners.
A monitoring plan should identify the questions being checked, the source of information, the review frequency and the person who can take action. Select signals that relate to the intended purpose: changes in error patterns, unexpected uses, user complaints or important supplier notices.
Combine scheduled reviews with event-triggered checks. A serious concern should not wait for the next quarterly meeting simply because a calendar review already exists.
Reconnect changes to the earlier approval.
Record changes in model or supplier version, data inputs, affected groups, integration behaviour and business purpose. Ask which assumptions in the previous assessment are no longer reliable. A small technical update can be material to a particular use case, while another change may require only a recorded confirmation.
- Describe the change and the systems affected.
- Identify the decision or evidence that may be invalidated.
- Assign the required review and interim restrictions.
- Record the outcome before expanded use is approved.
Close the loop on findings.
An incident or monitoring finding should lead to an owner, a decision and a record of the action taken. Distinguish investigation, containment, corrective work and verification of the result. Closure needs evidence that the agreed action was completed, not just a changed status.
EUAIC can support the design of these records and review routes. Automated technical monitoring, supplier integrations and alerting coverage must be separately agreed; this workflow description is not a promise of continuous inspection of every model output.