Post-market monitoring under Article 72: what to log

Article 72 requires providers of high-risk AI systems to establish and document a post-market monitoring system, proportionate to the system's nature and risks. In plain terms: you have to keep watching a high-risk system after it ships, not just document it once before launch.

What the monitoring system has to cover

The monitoring system has to actively and systematically collect, document, and analyze relevant data on the system's performance throughout its lifetime, provided by deployers or gathered through other sources, that allows the provider to evaluate continuous compliance with the Act's requirements.

What that means in practice

• Performance drift. Is the system's accuracy or behavior changing over time relative to what was validated pre-deployment? This requires logging outcomes, not just inputs.
• Errors and failure modes. What actually goes wrong in production — timeouts, invalid tool responses, unexpected model outputs — and how often.
• Human-oversight activity. How often and in what circumstances a human intervenes, overrides, or approves the system's outputs. This is direct evidence for the Article 14 human oversight requirement as well.
• Serious incidents. Article 73 separately requires reporting serious incidents to market surveillance authorities within set timeframes — you can't report what you haven't logged.
• Version and configuration changes. What changed, when, and why — needed both for Annex IV's change-log requirement and to correlate behavior shifts with deployments.

Where this data already exists

If your AI agent emits OpenTelemetry spans, LangSmith runs, AgentOps sessions, or MCP tool-call logs, most of the raw material for post-market monitoring is already being produced — it just isn't organized against the Act's specific requirements. The gap is usually structuring: turning a stream of trace events into a monitoring record that maps to Article 72's obligations and Annex IV's monitoring section. That structuring problem is what Attestly automates.