What specific metrics belong in an AI Act post-market monitoring plan for a medical device?

Relevant metrics typically include model performance drift over time, calibration checks against real-world outcomes, subgroup performance stability across demographic categories, and any thresholds that would trigger investigation or a retraining decision. These metrics should be integrated with whatever PMCF or PMPF data collection the device already performs under MDR or IVDR, so the same real-world performance data serves both regulatory purposes simultaneously.

What is the risk of running separate, disconnected AI Act and MDR post-market programs?

Regulators expect one integrated view of a device's real-world performance, and maintaining two disconnected programs, one for AI Act compliance and one for MDR post-market surveillance, creates the risk of inconsistent conclusions, duplicated effort, and gaps where a signal detected in one program is not communicated to the team running the other. Notified Bodies and market surveillance authorities are likely to ask how the two programs are reconciled, and a fragmented answer undermines confidence in the manufacturer's overall oversight.

How proportionate must the AI Act post-market monitoring system be?

Article 72 explicitly requires the monitoring system to be proportionate to the nature of the AI technologies involved and the risks they present, meaning a simple, low-risk algorithmic function does not need the same monitoring intensity as a complex adaptive model making high-stakes clinical decisions. Manufacturers should document the risk-based rationale behind their chosen monitoring intensity and metrics rather than applying a one-size-fits-all monitoring template across an entire product portfolio.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Quality System

AI Act Post-Market Monitoring

Ongoing, documented monitoring of a high-risk AI system's performance after it is placed on the market.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 72 requires providers of high-risk AI systems to establish and document a post-market monitoring system proportionate to the nature of the AI technologies and the risks. The plan must actively and systematically collect, document, and analyse relevant data throughout the lifetime of the system to evaluate continuous compliance. The plan forms part of the technical documentation. For AI that is also a medical device, these activities can be folded into existing MDR or IVDR post-market surveillance systems, as long as an equivalent level of protection is achieved.

What the regulation says

Regulation (EU) 2024/1689, adopted on 13 June 2024 and in force since 1 August 2024, requires providers of high-risk AI systems to establish and document post-market monitoring proportionate to the technologies and risks. Article 72 requires active, systematic collection, documentation and analysis of relevant performance data throughout the system’s lifetime to evaluate continuous compliance. Data may come from deployers or other sources. Monitoring must, where relevant, analyse interactions with other AI systems. The monitoring plan forms part of the technical documentation. The Regulation generally applies from 2 August 2026; Article 6(1) and corresponding obligations apply from 2 August 2027. For MedTech AI qualifying as high-risk under Article 6(1), Article 72 permits integration into existing sectoral post-market systems and plans, provided an equivalent level of protection is achieved. Relevant frameworks include Regulation (EU) 2017/745, Article 83 and Annex III, applicable since 26 May 2021, and Regulation (EU) 2017/746, Article 78 and Annex III, applicable since 26 May 2022. Integration must cover the AI-specific monitoring requirements, not merely reuse device surveillance paperwork. Post-market clinical follow-up or post-market performance follow-up can contribute evidence but does not, by itself, replace the complete AI monitoring system.

What this means in practice

For MedTech, the AI Act PMM plan should be integrated with the MDR/IVDR post-market surveillance plan and the PMCF/PMPF where required. Drift metrics, calibration checks, and real-world performance thresholds belong in both plans, not as parallel programmes.

Examples

A manufacturer of an AI-powered diagnostic imaging system continuously collects data on its performance in clinical settings, monitoring for drift in diagnostic accuracy and potential biases across different patient demographics.
A provider of an AI-assisted surgical planning tool implements a system to track real-world calibration checks and alert thresholds, ensuring the AI maintains its precision and safety over time after deployment.
A developer of an AI-driven patient monitoring device integrates its AI Act post-market monitoring plan with its MDR post-market surveillance, using shared metrics to evaluate the AI's ongoing effectiveness in detecting adverse events.

Common pitfalls

•Running two disconnected post-market programmes for the same device. Regulators expect one integrated view of performance.

Frequently asked questions

Article 72 requires providers of high-risk AI systems to actively and systematically collect, document, and analyze data throughout the system's lifetime specifically to evaluate continuous compliance with AI Act requirements such as accuracy, robustness, and bias. MDR post-market surveillance under Article 83 is broader in scope, covering the device's overall safety and performance, and includes PMCF for clinical claims. For AI-enabled medical devices, these two obligations overlap substantially and should be run as one integrated program rather than duplicated separately.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

Post-Market

Post-Market Clinical Follow-up(PMCF)

Proactive collection of clinical data on a CE-marked device to confirm safety and performance.

Post-Market

Post-Market Surveillance(PMS)

Activities to monitor device safety and performance after market release.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 2

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1FDA·1European Commission·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

Ongoing, documented monitoring of a high-risk AI system's performance after it is placed on the market.

·For MedTech, the AI Act PMM plan should be integrated with the MDR/IVDR post-market surveillance plan and the PMCF/PMPF where required.
·Drift metrics, calibration checks, and real-world performance thresholds belong in both plans, not as parallel programmes.
·The plan must actively and systematically collect, document, and analyse relevant data throughout the lifetime of the system to evaluate continuous compliance.

Remember this

Watch out: Running two disconnected post-market programmes for the same device. Regulators expect one integrated view of performance.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.