Post-Market Monitoring & Serious Incident Management
EU AI Act Compliance Post-Market Monitoring
+ On this page
Key takeaways
- All deployed AI systems must have a live Post-Market Monitoring Plan (PMMP) with metrics, thresholds, and responsibilities.
- Serious incidents must be reported to competent authorities within 15 days (Article 62 EU AI Act).
- PMM feeds into Zen AI’s AIMS continuous improvement cycle and quarterly board reviews.
Purpose & objectives
Post-Market Monitoring (PMM) provides continuous oversight of AI system performance, safety, and compliance after deployment.
It detects drift, bias, security incidents, and user complaints to maintain conformity throughout the AI lifecycle.
Monitoring triggers & data sources
- Performance KPIs (F1, latency, fairness gap, error rates)
- Security alerts (unauthorised access, prompt injection, data breach)
- User feedback & complaints through Zen Helpdesk or AnswerBot
- Bias audit results and model drift scores
- Incident reports from clients or regulators
PMM dashboard & metrics
| Metric Category | Example KPIs | Alert Threshold | Action Owner |
|---|
| Accuracy & Reliability | Δ Accuracy > 5 %, model fail rate > 2 % | Warning > 24 h | AI Ops Lead |
| Fairness & Bias | Demographic TPR gap > 5 % | Immediate review | Ethics Officer |
| Security | Prompt injection success > 1 % | Rollback in 1 h | Security Manager |
| User Complaints | > 10 per month or 1 severity ≥ 2 | Escalate to Governance Board | Compliance Lead |
Serious incident criteria & workflow
A serious incident is any event that results in or is likely to result in death, serious injury, legal non-compliance, systemic bias, or rights violation.
Zen AI follows this response workflow:
Detect → Contain → Assess severity → Notify Compliance → Begin RCA → Report to Authority → Implement CAPA → Close & Review
Regulatory reporting timeline (EU AI Act Art. 62)
| Stage | Action | Deadline | Responsible |
|---|
| Detection | Identify incident & record in PMM system | Immediate | AI Ops Lead |
| Preliminary Assessment | Confirm severity and potential harm | < 24 h | Compliance Lead |
| Authority Notification | Report serious incident to regulator | < 15 days | DPO / Legal |
| Follow-Up Report | Provide RCA, CAPA, and evidence updates | Within 30 days | Governance Board |
Integration with CAPA & RMS
- All PMM incidents auto-generate CAPA entries in the AIMS log.
- CAPA closure triggers RMS update to re-score residual risk.
- Quarterly RMS reviews identify recurring failure patterns for policy updates.
A) Post-Market Monitoring Report Template
| Section | Content / Example |
|---|
| System Name | ComplaintBot v2.1 |
| Reporting Period | Q4 2025 |
| Performance KPIs | Accuracy 0.91 (-2 % vs Q3); Fairness gap 3 % |
| Incidents Detected | 2 (SEV-2 bias drift events) |
| Actions Taken | Retrained model, updated dataset metadata |
| CAPA Status | Closed – EV-ID: CAPA-2025-0412 |
B) Serious Incident Notification Form (Authority Submission)
Incident ID: INC-AI-2025-004
System: HighRiskModel-X
Detected: 2025-10-02 14:40 UTC
Description: Bias in credit scoring model impacting demographic group
Immediate Action: Model rollback + manual review process
Preliminary Impact: 35 users; no financial harm confirmed
Reported to: EU AI Authority / ICO UK
Follow-up: CAPA-2025-0101 initiated; monitoring active
Framework alignment
| Framework | Reference | Relevance |
|---|
| EU AI Act | Art. 61–65 | Post-market monitoring & reporting obligations. |
| ISO/IEC 42001 | §10 | Improvement & nonconformity management. |
| NIST AI RMF | Manage & Measure | Continuous monitoring & risk mitigation. |
| UK DSIT Framework | Principle 5 | Accountability & ongoing oversight. |
Implementation checklist
- PMM dashboard active with thresholds and owners assigned.
- Incident workflow integrated with CAPA and RMS logs.
- Serious incident forms ready for regulator submission.
- Quarterly PMM reports reviewed by AI Governance Board.
- Evidence IDs linked to TDF and AIMS repositories.
© Zen AI Governance UK Ltd • Regulatory Knowledge • v1 17 Nov 2025 • This page is general guidance, not legal advice