Post-market monitoring system
Description
Article 61 — Provider establishes a post-market monitoring system proportionate to risk; collects telemetry; analyses for emerging risks.
⚠️ Risk Impact
Without post-market monitoring, the provider doesn't know how the system performs in deployment until customer complaints surface. By then, harm has accumulated and the regulator has heard about it.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Wire customer-side telemetry (with consent + privacy preservation) to a provider-side monitoring system. Analyse for emerging risk patterns. Surface findings in periodic post-market monitoring reports.
💀 Real-World Attack Scenario
A speech-recognition AI vendor relied on customer feedback to identify performance issues. A pattern of degraded accuracy on non-native-English speakers built up over 11 months before a deployer raised it. The vendor's post-market monitoring system existed on paper but did not detect the pattern.
💰 Cost of Non-Compliance
Article 61 monitoring gap: up to €15M / 3% revenue. Avg cost of post-launch-discovered AI issue: 7× higher than pre-launch-detected (Stanford HAI 2024).
📋 Audit Questions
- 1.Show me your most recent post-market monitoring report.
- 2.What signals are monitored? With what frequency?
- 3.How is monitoring data ingested from deployers?
- 4.What was the last emerging risk identified through post-market monitoring?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Monitoring system exists but isn't actually pulling data from deployers (e.g. opt-in only at signup, no one opts in)
- ⛔Surface-level dashboards without anomaly detection — drift goes unnoticed
- ⛔Findings aren't fed back into design — monitoring becomes a dead-end report
📈 Business Value
Effective post-market monitoring catches issues at 7× lower cost than post-customer-complaint discovery. Material in both Article 61 compliance and product quality.
⏱️ Effort Estimate
4-6 weeks for monitoring system + reporting cadence
EchelonGraph runs the post-market monitoring layer for KServe/Kubeflow/Ray workloads out of the box
🔗 Cross-Framework References
Automate EU AI Act ART61-POST-MARKET compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →