Skip to content

Regulation Tracker / EU AI Act / Chapter IX · Section 1

Article 72
Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems

Chapter IX — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems, Section 1 — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems. 7 distinct duties, powers or definitions are coded from this article, applying from 2026-08-02. 4 reach legal practice directly.

Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27 — about 99 words changed. The text below is the consolidated version of 27 July 2026; the 2024 text and the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. Providers shall establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system.

2. The post-market monitoring system shall actively and systematically collect, document and analyse relevant data which may be provided by deployers or which may be collected through other sources on the performance of high-risk AI systems throughout their lifetime, and which allow the provider to evaluate the continuous compliance of AI systems with the requirements set out in Chapter III, Section 2. Where relevant, post-market monitoring shall include an analysis of the interaction with other AI systems. This obligation shall not cover sensitive operational data of deployers which are law-enforcement authorities.

3. The post-market monitoring system shall be based on a post-market monitoring plan. The post-market monitoring plan shall be part of the technical documentation referred to in Annex IV. The Commission, taking utmost account of the opinion of the Board, shall adopt guidance, including a template, on the post-market monitoring plan by 2 September 2027.

4. For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, where a post-market monitoring system and plan are already established under that legislation, in order to ensure consistency, avoid duplications and minimise additional burdens, providers shall have a choice of integrating, as appropriate, the necessary elements described in paragraphs 1, 2 and 3 using the template referred in paragraph 3 into systems and plans already existing under that legislation, provided that it achieves an equivalent level of protection.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

  1. Art. 72(1)MonitoringHigh-risklegal practice

    Providers of high-risk AI systems must establish and document a proportionate post-market monitoring system for the nature and risks of the system.

    "Providers shall establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — A legal-AI vendor whose system is high-risk must operate documented post-market monitoring.
    See
    Chapter III Section 2

  2. Art. 72(2)MonitoringHigh-risklegal practice

    Post-market monitoring must allow the provider to evaluate continuous compliance with Chapter III Section 2 requirements and, where relevant, interactions with other AI systems.

    "allow the provider to evaluate the continuous compliance of AI systems with the requirements set out in Chapter III, Section 2. Where relevant, post-market monitoring shall include an analysis of the interaction with other AI systems."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — Compliance monitoring for high-risk legal AI must consider continuing conformity and relevant interactions with other systems.
    See
    Chapter III Section 2

  3. Art. 72(2)MonitoringHigh-risklegal practice

    The post-market monitoring system must actively and systematically collect, document and analyse relevant performance data throughout the high-risk AI system lifetime.

    "The post-market monitoring system shall actively and systematically collect, document and analyse relevant data which may be provided by deployers or which may be collected through other sources"
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — High-risk legal-AI providers must analyse deployer and other data to check continuing compliance.
    See
    Chapter III Section 2

  4. Art. 72(2)Derogation or exemptionHigh-risk

    The post-market monitoring data obligation excludes sensitive operational data of deployers that are law-enforcement authorities.

    "This obligation shall not cover sensitive operational data of deployers which are law-enforcement authorities."
    Who
    Provider, Public-authority deployer
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Institutional — This carve-out is specific to law-enforcement deployers rather than ordinary legal practice.
    See
    Art. 72(2)

  5. Art. 72(3)Support measureHigh-risk

    The Commission must adopt guidance, including a template, on the post-market monitoring plan by 2 September 2027, taking utmost account of the Board opinion.

    "The Commission, taking utmost account of the opinion of the Board, shall adopt guidance, including a template, on the post-market monitoring plan by 2 September 2027."
    Who
    Commission
    From
    (Art. 113 second subparagraph (general application))Guidance deadline: 2 September 2027.
    Legal practice
    Reaches legal-AI vendors or public bodies — The guidance will shape documentation expectations for high-risk legal-AI providers.
    See
    ai-board

  6. Art. 72(3)DocumentationHigh-risklegal practice

    The post-market monitoring system must be based on a plan that forms part of the Annex IV technical documentation.

    "The post-market monitoring system shall be based on a post-market monitoring plan. The post-market monitoring plan shall be part of the technical documentation referred to in Annex IV."
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Reaches legal practice directly — High-risk legal-AI providers must include the monitoring plan in technical documentation.
    See
    Annex IV

  7. Art. 72(4)Derogation or exemptionHigh-risk

    For Annex I Section A product systems with equivalent sectoral post-market monitoring, providers may integrate the AI Act elements into existing systems and plans.

    "providers shall have a choice of integrating, as appropriate, the necessary elements described in paragraphs 1, 2 and 3 using the template referred in paragraph 3 into systems and plans already existing under that legislation"
    Who
    Provider
    From
    (Art. 113 second subparagraph (general application))
    Legal practice
    Institutional — This mainly concerns product-regulated high-risk systems rather than legal-practice deployments.
    See
    Annex I Section A · Art. 72(1) · Art. 72(2) · Art. 72(3)

Cite

Regulation (EU) 2024/1689, Article 72 (Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_72 — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-72, accessed 2026-09-08, CC BY 4.0.