Post-Market Monitoring (PMM) — Lifecycle Operations
Post-Market Monitoring (PMM) — EU/UK aligned
EU AI Act Compliance Lifecycle Operations EU/UK aligned
+ On this page
Key takeaways
- PMM turns real-world behaviour into measurable signals with owners, thresholds and actions.
Objectives & KPIs
- Safety, fairness, privacy, explainability, security and operational continuity metrics per cohort.
Telemetry & minimisation
- Log schema consistent with RMS/incident needs; minimise raw content; pseudonymise identities.
Drift & bias surveillance
- Detect covariate/label drift and parity deviations; review windows; auto-open CAPA when breached.
Safety & security monitoring
- Abuse filters, adversarial triggers, RAG provenance failures, tool misuse, jailbreak attempts.
Alerts, thresholds & escalation
- Paged alerts with runbooks; escalation ladders; regulator notification triggers.
What is a “serious incident”?
- Actual or potential serious harm to health/safety/fundamental rights; material breach of law; defined internally with examples.
Reporting workflow (EU/UK)
- Immediate triage; initial notice within required timelines; investigation bundle; corrective actions and follow-up reports.
CAPA & effectiveness
- Root cause; corrective and preventive tasks; owners; deadlines; effectiveness checks; RMS updates.
Feedback loops & model updates
- Controlled data/product updates; waiver handling; cohort-wise monitoring post-fix.
Governance & reviews
- Monthly safety reviews; quarterly executive summaries; annual independent assurance.
Evidence & records
- Dashboards, alerts, incident bundles, CAPA tickets, approvals; immutable snapshots for audits.
Implementation checklist
- Metrics, thresholds, paging, incidents, CAPA and reviews are live and linked to evidence.
© Zen AI Governance UK Ltd • Regulatory Knowledge • v1 05 Nov 2025 • This page is general guidance, not legal advice.